Knowns CVE-2026-88940

The knowns workspace browse HTTP endpoint must be reachable over the network. No authentication is required (PR:N). No special configuration or non-default state is required - any deployed instance of knowns through 0.33.0 with a network-accessible port is vulnerable. Exploitation is bounded to directory enumeration: the attacker can discover directory names and structure but cannot read file contents through this vulnerability alone, limiting the immediate blast radius to reconnaissance.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately captures the threat model: zero-friction unauthenticated network exploitation with impact capped at limited confidentiality (directory names, not file content). No KEV listing exists and no public exploit code has been identified, placing real-world urgency below scores for file-read or code-execution path-traversal variants. That said, directory enumeration is a valuable reconnaissance primitive - an attacker who can map the host's project layout can identify additional targets, and even a mid-sized municipal IT team in malbork should treat unauthenticated filesystem enumeration on a network-exposed tool as a non-trivial exposure worth prompt patching. EPSS data is absent from the input; exploitation likelihood is assessed as low in the near term given the product's niche footprint.

An unauthenticated attacker sends HTTP GET requests to the workspace browse endpoint with a path parameter containing traversal sequences such as ../../etc or ../../home. By iterating through common filesystem paths, the attacker enumerates directory names across the host, mapping project layouts, identifying backup or configuration directories, and selecting targets for follow-on access attempts. The attack requires no credentials and no exploit tooling beyond a basic HTTP client.