Vulnerability-Lookup

GHSA-9GFJ-28HW-JCHP

Vulnerability from github – Published: 2026-09-25 19:32 – Updated: 2026-09-25 19:32

Summary

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Details

Overview

Verified. Multiple Unrestricted Path Traversal vulnerabilities exist in the Knowns MCP docs and memory tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (Get, Create, Update, Rename, Delete) in both doc_store.go and memory_store.go concatenate user-controlled paths with filepath.Join() without any containment validation.

Additionally, the docs.update action with a newPath parameter performs a file deletion via Rename(), but is classified as CapWrite in the permission registry rather than CapDelete. This allows an attacker with a read-write-no-delete preset to bypass deletion restrictions and destroy arbitrary files outside the project root.

Affected paths

File Path	Role	Vulnerability & Execution Impact
`internal/storage/doc_store.go`	Vulnerable Sink (Docs)	Path Traversal in File Operations (CWE-22): `Get()`, `Create()`, `Update()`, `Rename()`, `Delete()` join user-controlled `path` with `filepath.Join(ds.docsDir(), ...)` without validating path containment.
`internal/storage/memory_store.go`	Vulnerable Sink (Memory)	Path Traversal in Memory Operations (CWE-22): `GetInLayer()`, `Create()`, `Update()`, `Delete()` join user-controlled `id` with `filepath.Join(dir, models.MemoryFileName(id))` without validation.
`internal/mcp/handlers/doc.go`	Pass-Through Handler	Unsanitized Input Propagation: MCP handlers pass user-supplied `path`, `folder`, `newPath` directly to storage layer without sanitization.
`internal/mcp/handlers/memory.go`	Pass-Through Handler	Unsanitized Input Propagation: MCP handlers pass user-supplied `id` directly to storage layer without sanitization.
`internal/permissions/registry.go`	Authorization Bypass	Capability Misclassification (CWE-863): `docs.update` with `newPath` performs file deletion but is classified as `CapWrite`, bypassing `CapDelete` restrictions.

Root Cause

Missing Path Containment in DocStore

In internal/storage/doc_store.go, all file operations use filepath.Join() to construct absolute paths without validating that the resolved path remains within docsDir():

// Get retrieves a doc by its relative path (without .md extension).
func (ds *DocStore) Get(path string) (*models.Doc, error) {
    path = strings.TrimPrefix(path, "/")
    path = strings.TrimSuffix(path, ".md")

    // VULNERABLE: No containment check
    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+".md")
    if _, err := os.Stat(absPath); err == nil {
        // ...
        return ds.parseFile(absPath, path, folder, false, "")
    }
    // ...
}

// Create writes a new doc to .knowns/docs/{path}.md.
func (ds *DocStore) Create(doc *models.Doc) error {
    if doc.Path == "" {
        return fmt.Errorf("doc path is required")
    }
    // VULNERABLE: No containment check
    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md")
    if err := os.MkdirAll(filepath.Dir(absPath), 0755); err != nil {
        return fmt.Errorf("create doc dir: %w", err)
    }
    return ds.writeFile(absPath, doc)
}

// Rename rewrites a doc to a new path and removes the old file.
func (ds *DocStore) Rename(oldPath string, doc *models.Doc) error {
    // ...
    oldAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(oldPath, ".md"))+".md")
    newAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(doc.Path, ".md"))+".md")
    // ...
    if err := ds.writeFile(newAbsPath, doc); err != nil {
        return err
    }
    if oldAbsPath != newAbsPath {
        // VULNERABLE: Deletes file at oldAbsPath (can be outside docsDir)
        if err := os.Remove(oldAbsPath); err != nil && !os.IsNotExist(err) {
            return err
        }
    }
    return nil
}

// Delete removes a doc file.
func (ds *DocStore) Delete(path string) error {
    path = strings.TrimSuffix(path, ".md")
    // VULNERABLE: No containment check
    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+".md")
    return os.Remove(absPath)
}

Critical Flaws: - filepath.Join resolves ../ sequences natively - No post-Join prefix check (e.g., strings.HasPrefix(absPath, ds.docsDir())) - No rejection of absolute paths or path traversal sequences - Rename() performs file deletion via os.Remove(oldAbsPath), which can target files outside the docs directory

Missing Path Containment in MemoryStore

In internal/storage/memory_store.go, memory operations similarly lack path validation:

// GetInLayer retrieves a memory entry by ID from a specific layer only.
func (ms *MemoryStore) GetInLayer(id, layer string) (*models.MemoryEntry, error) {
    // ...
    dir, err := ms.dirForLayer(layer)
    if err != nil {
        return nil, err
    }
    // VULNERABLE: No containment check for id containing "../"
    absPath := filepath.Join(dir, models.MemoryFileName(id))
    if _, err := os.Stat(absPath); err != nil {
        return nil, fmt.Errorf("memory %q not found in %s layer", id, layer)
    }
    return ms.parseFile(absPath, layer)
}

// Create writes a new memory entry to the appropriate layer directory.
func (ms *MemoryStore) Create(entry *models.MemoryEntry) error {
    // ...
    dir, err := ms.dirForLayer(entry.Layer)
    if err != nil {
        return err
    }
    if err := os.MkdirAll(dir, 0755); err != nil {
        return fmt.Errorf("create memory dir: %w", err)
    }

    // VULNERABLE: No containment check for entry.ID containing "../"
    absPath := filepath.Join(dir, models.MemoryFileName(entry.ID))
    return atomicWrite(absPath, []byte(renderMemory(entry)))
}

// Delete removes a memory entry by ID.
func (ms *MemoryStore) Delete(id string) error {
    // ...
    filename := models.MemoryFileName(id)

    dirs := []string{ms.projectDir(), ms.globalDir()}
    for _, dir := range dirs {
        // VULNERABLE: No containment check
        absPath := filepath.Join(dir, filename)
        if _, err := os.Stat(absPath); err == nil {
            return os.Remove(absPath)
        }
    }

    return fmt.Errorf("memory %q not found", id)
}

Authorization Bypass via Rename-as-Delete

In internal/mcp/handlers/doc.go, the handleDocUpdate() function accepts a newPath parameter that triggers a rename operation:

func handleDocUpdate(getStore func() *storage.Store, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {
    // ...
    if v, ok := stringArg(args, "newPath"); ok && strings.TrimSpace(v) != "" {
        doc.Path = strings.Trim(strings.TrimSuffix(v, ".md"), "/")
    }
    // ...
    if oldPath != doc.Path {
        if err := store.Docs.Rename(oldPath, doc); err != nil {
            return errFailed("rename doc", err)
        }
        // ...
    }
    // ...
}

The Rename() function in doc_store.go performs file deletion:

if oldAbsPath != newAbsPath {
    if err := os.Remove(oldAbsPath); err != nil && !os.IsNotExist(err) {
        return err
    }
}

However, in internal/permissions/registry.go, docs.update is classified as CapWrite:

"docs.update":  {Capability: CapWrite, Target: TargetDoc, Risk: RiskMedium},

This allows an attacker with a read-write-no-delete preset (which permits CapWrite but denies CapDelete) to delete files by using docs.update with a newPath parameter.

Attack Vector

Phase	Request / Action	Effect
1. Arbitrary File Read	`docs.get` with `path="../../../victim/secret"`	Server reads file outside project root via path traversal in `DocStore.Get()`.
2. Arbitrary File Write	`docs.create` with `folder="../../../victim"`	Server writes file outside project root via path traversal in `DocStore.Create()`.
3. Arbitrary File Delete	`docs.update` with `path="../outside/secret.md"` and `newPath="../../../victim/renamed.md"`	Server deletes file outside project root via path traversal in `DocStore.Rename()`. Bypasses `CapDelete` restriction because `docs.update` is classified as `CapWrite`.
4. Memory File Read/Write	`memory.update` with `id="x/../../../../victim/secret"`	Server reads and overwrites file outside project root via path traversal in `MemoryStore.Update()`.

Analysis

Classic Path Traversal Pattern

Both DocStore and MemoryStore follow the same vulnerable pattern: user-controlled input is concatenated with a base directory using filepath.Join(), then passed directly to file system operations (os.ReadFile, os.WriteFile, os.Remove, os.Stat) without any validation.

absPath := filepath.Join(baseDir, filepath.FromSlash(userInput))
// No containment check: strings.HasPrefix(absPath, baseDir)
// No rejection of ".." or absolute paths

filepath.Join resolves ../ sequences, allowing attackers to escape the intended directory: - Input: "../../../etc/passwd" - Result: /project/.knowns/docs/../../../etc/passwd → /etc/passwd

Rename-as-Delete Authorization Bypass

The Rename() function performs two operations: 1. Write the file to the new location (newAbsPath) 2. Delete the file from the old location (oldAbsPath)

Both paths are vulnerable to traversal. An attacker can: - Set path to a file outside the project (e.g., "../../../victim/target.md") - Set newPath to another location outside the project - The Rename() function will delete the file at path (outside the project)

Because docs.update is classified as CapWrite rather than CapDelete, this operation bypasses deletion restrictions in read-write-no-delete presets.

Compounding Factor - Unauthenticated Access

Due to the previously identified Auth Bypass vulnerability, all MCP tools are accessible without credentials when the server is started without a password, making this a zero-credential attack.

Fix

Patch is available right now at New Release.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.29.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "knowns"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.30.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-86439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-306",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-25T19:32:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Overview\n\nVerified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memory` tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (`Get`, `Create`, `Update`, `Rename`, `Delete`) in both `doc_store.go` and `memory_store.go` concatenate user-controlled paths with `filepath.Join()` without any containment validation. \n\nAdditionally, the `docs.update` action with a `newPath` parameter performs a file deletion via `Rename()`, but is classified as `CapWrite` in the permission registry rather than `CapDelete`. This allows an attacker with a `read-write-no-delete` preset to bypass deletion restrictions and destroy arbitrary files outside the project root.\n\n## Affected paths\n\n| File Path | Role | Vulnerability \u0026 Execution Impact |\n| :--- | :--- | :--- |\n| **`internal/storage/doc_store.go`** | Vulnerable Sink (Docs) | **Path Traversal in File Operations (CWE-22):** `Get()`, `Create()`, `Update()`, `Rename()`, `Delete()` join user-controlled `path` with `filepath.Join(ds.docsDir(), ...)` without validating path containment. |\n| **`internal/storage/memory_store.go`** | Vulnerable Sink (Memory) | **Path Traversal in Memory Operations (CWE-22):** `GetInLayer()`, `Create()`, `Update()`, `Delete()` join user-controlled `id` with `filepath.Join(dir, models.MemoryFileName(id))` without validation. |\n| **`internal/mcp/handlers/doc.go`** | Pass-Through Handler | **Unsanitized Input Propagation:** MCP handlers pass user-supplied `path`, `folder`, `newPath` directly to storage layer without sanitization. |\n| **`internal/mcp/handlers/memory.go`** | Pass-Through Handler | **Unsanitized Input Propagation:** MCP handlers pass user-supplied `id` directly to storage layer without sanitization. |\n| **`internal/permissions/registry.go`** | Authorization Bypass | **Capability Misclassification (CWE-863):** `docs.update` with `newPath` performs file deletion but is classified as `CapWrite`, bypassing `CapDelete` restrictions. |\n\n## Root Cause\n\n### Missing Path Containment in DocStore\n\nIn `internal/storage/doc_store.go`, all file operations use `filepath.Join()` to construct absolute paths without validating that the resolved path remains within `docsDir()`:\n\n```go\n// Get retrieves a doc by its relative path (without .md extension).\nfunc (ds *DocStore) Get(path string) (*models.Doc, error) {\n    path = strings.TrimPrefix(path, \"/\")\n    path = strings.TrimSuffix(path, \".md\")\n\n    // VULNERABLE: No containment check\n    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+\".md\")\n    if _, err := os.Stat(absPath); err == nil {\n        // ...\n        return ds.parseFile(absPath, path, folder, false, \"\")\n    }\n    // ...\n}\n\n// Create writes a new doc to .knowns/docs/{path}.md.\nfunc (ds *DocStore) Create(doc *models.Doc) error {\n    if doc.Path == \"\" {\n        return fmt.Errorf(\"doc path is required\")\n    }\n    // VULNERABLE: No containment check\n    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+\".md\")\n    if err := os.MkdirAll(filepath.Dir(absPath), 0755); err != nil {\n        return fmt.Errorf(\"create doc dir: %w\", err)\n    }\n    return ds.writeFile(absPath, doc)\n}\n\n// Rename rewrites a doc to a new path and removes the old file.\nfunc (ds *DocStore) Rename(oldPath string, doc *models.Doc) error {\n    // ...\n    oldAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(oldPath, \".md\"))+\".md\")\n    newAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(doc.Path, \".md\"))+\".md\")\n    // ...\n    if err := ds.writeFile(newAbsPath, doc); err != nil {\n        return err\n    }\n    if oldAbsPath != newAbsPath {\n        // VULNERABLE: Deletes file at oldAbsPath (can be outside docsDir)\n        if err := os.Remove(oldAbsPath); err != nil \u0026\u0026 !os.IsNotExist(err) {\n            return err\n        }\n    }\n    return nil\n}\n\n// Delete removes a doc file.\nfunc (ds *DocStore) Delete(path string) error {\n    path = strings.TrimSuffix(path, \".md\")\n    // VULNERABLE: No containment check\n    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+\".md\")\n    return os.Remove(absPath)\n}\n```\n\n**Critical Flaws:**\n- `filepath.Join` resolves `../` sequences natively\n- No post-Join prefix check (e.g., `strings.HasPrefix(absPath, ds.docsDir())`)\n- No rejection of absolute paths or path traversal sequences\n- `Rename()` performs file deletion via `os.Remove(oldAbsPath)`, which can target files outside the docs directory\n\n### Missing Path Containment in MemoryStore\n\nIn `internal/storage/memory_store.go`, memory operations similarly lack path validation:\n\n```go\n// GetInLayer retrieves a memory entry by ID from a specific layer only.\nfunc (ms *MemoryStore) GetInLayer(id, layer string) (*models.MemoryEntry, error) {\n    // ...\n    dir, err := ms.dirForLayer(layer)\n    if err != nil {\n        return nil, err\n    }\n    // VULNERABLE: No containment check for id containing \"../\"\n    absPath := filepath.Join(dir, models.MemoryFileName(id))\n    if _, err := os.Stat(absPath); err != nil {\n        return nil, fmt.Errorf(\"memory %q not found in %s layer\", id, layer)\n    }\n    return ms.parseFile(absPath, layer)\n}\n\n// Create writes a new memory entry to the appropriate layer directory.\nfunc (ms *MemoryStore) Create(entry *models.MemoryEntry) error {\n    // ...\n    dir, err := ms.dirForLayer(entry.Layer)\n    if err != nil {\n        return err\n    }\n    if err := os.MkdirAll(dir, 0755); err != nil {\n        return fmt.Errorf(\"create memory dir: %w\", err)\n    }\n\n    // VULNERABLE: No containment check for entry.ID containing \"../\"\n    absPath := filepath.Join(dir, models.MemoryFileName(entry.ID))\n    return atomicWrite(absPath, []byte(renderMemory(entry)))\n}\n\n// Delete removes a memory entry by ID.\nfunc (ms *MemoryStore) Delete(id string) error {\n    // ...\n    filename := models.MemoryFileName(id)\n\n    dirs := []string{ms.projectDir(), ms.globalDir()}\n    for _, dir := range dirs {\n        // VULNERABLE: No containment check\n        absPath := filepath.Join(dir, filename)\n        if _, err := os.Stat(absPath); err == nil {\n            return os.Remove(absPath)\n        }\n    }\n\n    return fmt.Errorf(\"memory %q not found\", id)\n}\n```\n\n### Authorization Bypass via Rename-as-Delete\n\nIn `internal/mcp/handlers/doc.go`, the `handleDocUpdate()` function accepts a `newPath` parameter that triggers a rename operation:\n\n```go\nfunc handleDocUpdate(getStore func() *storage.Store, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {\n    // ...\n    if v, ok := stringArg(args, \"newPath\"); ok \u0026\u0026 strings.TrimSpace(v) != \"\" {\n        doc.Path = strings.Trim(strings.TrimSuffix(v, \".md\"), \"/\")\n    }\n    // ...\n    if oldPath != doc.Path {\n        if err := store.Docs.Rename(oldPath, doc); err != nil {\n            return errFailed(\"rename doc\", err)\n        }\n        // ...\n    }\n    // ...\n}\n```\n\nThe `Rename()` function in `doc_store.go` performs file deletion:\n\n```go\nif oldAbsPath != newAbsPath {\n    if err := os.Remove(oldAbsPath); err != nil \u0026\u0026 !os.IsNotExist(err) {\n        return err\n    }\n}\n```\n\nHowever, in `internal/permissions/registry.go`, `docs.update` is classified as `CapWrite`:\n\n```go\n\"docs.update\":  {Capability: CapWrite, Target: TargetDoc, Risk: RiskMedium},\n```\n\nThis allows an attacker with a `read-write-no-delete` preset (which permits `CapWrite` but denies `CapDelete`) to delete files by using `docs.update` with a `newPath` parameter.\n\n## Attack Vector\n\n| Phase | Request / Action | Effect |\n| :--- | :--- | :--- |\n| **1. Arbitrary File Read** | `docs.get` with `path=\"../../../victim/secret\"` | Server reads file outside project root via path traversal in `DocStore.Get()`. |\n| **2. Arbitrary File Write** | `docs.create` with `folder=\"../../../victim\"` | Server writes file outside project root via path traversal in `DocStore.Create()`. |\n| **3. Arbitrary File Delete** | `docs.update` with `path=\"../outside/secret.md\"` and `newPath=\"../../../victim/renamed.md\"` | Server deletes file outside project root via path traversal in `DocStore.Rename()`. Bypasses `CapDelete` restriction because `docs.update` is classified as `CapWrite`. |\n| **4. Memory File Read/Write** | `memory.update` with `id=\"x/../../../../victim/secret\"` | Server reads and overwrites file outside project root via path traversal in `MemoryStore.Update()`. |\n\n## Analysis\n\n### Classic Path Traversal Pattern\n\nBoth `DocStore` and `MemoryStore` follow the same vulnerable pattern: user-controlled input is concatenated with a base directory using `filepath.Join()`, then passed directly to file system operations (`os.ReadFile`, `os.WriteFile`, `os.Remove`, `os.Stat`) without any validation.\n\n```go\nabsPath := filepath.Join(baseDir, filepath.FromSlash(userInput))\n// No containment check: strings.HasPrefix(absPath, baseDir)\n// No rejection of \"..\" or absolute paths\n```\n\n`filepath.Join` resolves `../` sequences, allowing attackers to escape the intended directory:\n- Input: `\"../../../etc/passwd\"`\n- Result: `/project/.knowns/docs/../../../etc/passwd` \u2192 `/etc/passwd`\n\n### Rename-as-Delete Authorization Bypass\n\nThe `Rename()` function performs two operations:\n1. Write the file to the new location (`newAbsPath`)\n2. Delete the file from the old location (`oldAbsPath`)\n\nBoth paths are vulnerable to traversal. An attacker can:\n- Set `path` to a file outside the project (e.g., `\"../../../victim/target.md\"`)\n- Set `newPath` to another location outside the project\n- The `Rename()` function will delete the file at `path` (outside the project)\n\nBecause `docs.update` is classified as `CapWrite` rather than `CapDelete`, this operation bypasses deletion restrictions in `read-write-no-delete` presets.\n\n### Compounding Factor - Unauthenticated Access\n\nDue to the previously identified **Auth Bypass** vulnerability, all MCP tools are accessible without credentials when the server is started without a password, making this a zero-credential attack.\n\n## Fix\n\n*Patch is available right now at [New Release](https://github.com/knowns-dev/knowns/releases).*",
  "id": "GHSA-9gfj-28hw-jchp",
  "modified": "2026-09-25T19:32:05Z",
  "published": "2026-09-25T19:32:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/security/advisories/GHSA-9gfj-28hw-jchp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/knowns-dev/knowns"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/doc_store.go#L124-L129"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/memory_store.go#L203-L211"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/releases/tag/v0.30.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-mcp-doc-and-memory-tools"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools"
}

CVE-2026-86439 (GCVE-0-2026-86439)

Vulnerability from cvelistv5 – Published: 2026-09-07 23:03 – Updated: 2026-09-24 14:21

Title

knowns before 0.30.0 Path Traversal via MCP doc and memory tools

Summary

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 12:44 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://github.com/knowns-dev/knowns/security/adv…	vendor-advisory
https://github.com/knowns-dev/knowns/blob/v0.29.1…	technical-description
https://github.com/knowns-dev/knowns/blob/v0.29.1…	technical-description
https://github.com/knowns-dev/knowns/commit/09c5a…	patch
https://github.com/knowns-dev/knowns/releases/tag…	release-notes
https://www.vulncheck.com/advisories/knowns-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
knowns-dev	knowns	Affected: 0 , < 0.30.0 (semver) Unaffected: 0.30.0 (semver)

Date Public

2026-08-16 00:00

Credits

Tong Hoang Gia (uziii2208) Nguyen Huy Hoang (hoanggxyuuki)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86439",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T12:44:18.439489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T12:44:26.129Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/knowns",
          "product": "knowns",
          "vendor": "knowns-dev",
          "versions": [
            {
              "lessThan": "0.30.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.30.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tong Hoang Gia (uziii2208)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Nguyen Huy Hoang (hoanggxyuuki)"
        }
      ],
      "datePublic": "2026-08-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:21:21.100Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9gfj-28hw-jchp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/knowns-dev/knowns/security/advisories/GHSA-9gfj-28hw-jchp"
        },
        {
          "name": "DocStore.Get path join without containment (v0.29.1)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/doc_store.go#L124-L129"
        },
        {
          "name": "MemoryStore.GetInLayer path join without containment (v0.29.1)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/memory_store.go#L203-L211"
        },
        {
          "name": "knowns fix commit 09c5a96fd581",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e"
        },
        {
          "name": "knowns v0.30.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/knowns-dev/knowns/releases/tag/v0.30.0"
        },
        {
          "name": "VulnCheck Advisory: knowns before 0.30.0 Path Traversal via MCP doc and memory tools",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-mcp-doc-and-memory-tools"
        }
      ],
      "title": "knowns before 0.30.0 Path Traversal via MCP doc and memory tools",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86439",
    "datePublished": "2026-09-07T23:03:16.548Z",
    "dateReserved": "2026-09-07T12:34:31.457Z",
    "dateUpdated": "2026-09-24T14:21:21.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-9GFJ-28HW-JCHP

Overview

Affected paths

Root Cause

Missing Path Containment in DocStore

Missing Path Containment in MemoryStore

Authorization Bypass via Rename-as-Delete

Attack Vector

Analysis

Classic Path Traversal Pattern

Rename-as-Delete Authorization Bypass

Compounding Factor - Unauthenticated Access

Fix

CVE-2026-86439 (GCVE-0-2026-86439)

Tags

Sightings

Nomenclature

Related by attack behaviour