CVE-2026-86542: knowns Unauthenticated Arbitrary File Write via Import Name
Reading arbitrary files is bad. Writing them, with content you control, from an unauthenticated endpoint, is how a documentation import feature becomes a code execution chain.