EUVD-2026-72555
GHSA-qjrq-cvv4-3g9w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible MCP interface requires low-privilege authentication (PR:L); no scope change as impact is bounded by server process file permissions.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.
AnalysisAI
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authenticated remote attackers to read, create, overwrite, and delete arbitrary Markdown files accessible to the server process by supplying directory traversal sequences in MCP tool arguments. The flaw is rooted in the absence of any path containment validation in the storage layer (doc_store.go and memory_store.go), meaning MCP-issued file paths were passed directly to filesystem operations without sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated low-privilege access to the knowns MCP tool interface (PR:L per the CVSS 4.0 vector) over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) is well-calibrated: network-accessible, low complexity, requiring only low privilege, with full C/I/A impact on the vulnerable system and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade knowns to version 0.30.0 or later, released at https://github.com/knowns-dev/knowns/releases/tag/v0.30.0 and patched via commit 09c5a96fd5817b941dc86669278c1a17db10ed4e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running knowns versions prior to 0.30.0 and review recent access logs for suspicious file operations involving directory traversal patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the proje
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated i
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to re
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization con
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote att
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overw
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate p
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today