Skip to main content

Knowns CVE-2026-88940

| EUVDEUVD-2026-75583 MEDIUM
Path Traversal (CWE-22)
2026-09-10 VulnCheck GHSA-hm5p-8v8f-2vgm
Path Traversal Knowns
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Unauthenticated network-accessible endpoint with no complexity; confidentiality limited to directory names only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Sep 10, 2026 - 16:06 vuln.today

DescriptionCVE.org

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further exploitation.

AnalysisAI

Directory traversal in knowns through 0.33.0 exposes arbitrary host filesystem paths to unauthenticated remote attackers via the workspace browse endpoint's unsanitized path query parameter. Attackers can walk the directory tree to map project directories, configuration file locations, and other filesystem structures without any credentials or special privileges. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The knowns workspace browse HTTP endpoint must be reachable over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately captures the threat model: zero-friction unauthenticated network exploitation with impact capped at limited confidentiality (directory names, not file content). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult the vendor security advisory at https://github.com/knowns-dev/knowns/security/advisories/GHSA-h73x-698r-qrvg for the officially patched release version; no specific fixed version number is confirmed in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Knowns

View all
CVE-2026-86543 CRITICAL
9.3 Sep 07

Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces

CVE-2026-88899 CRITICAL
9.3 Sep 10

External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the proje
CVE-2026-86775 HIGH
8.8 Sep 09

Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read
CVE-2026-86542 HIGH
8.8 Sep 07

Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated i
CVE-2026-86439 HIGH
8.7 Sep 07

Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authentica
CVE-2026-86538 HIGH
8.7 Sep 07

Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to re
CVE-2026-88939 HIGH
8.7 Sep 10

Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization con
CVE-2026-88937 HIGH
8.6 Sep 10

Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote att
CVE-2026-86540 HIGH
8.5 Sep 07

Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted
CVE-2026-86541 HIGH
7.2 Sep 07

Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overw
CVE-2026-86544 HIGH
7.2 Sep 07

Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate p
CVE-2026-88938 HIGH
7.1 Sep 10

Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2026-88940 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy