CVE-2026-30632: Knowns Path Traversal Vulnerability

CVE-2026-30632 Overview

CVE-2026-30632 is a directory traversal vulnerability [CWE-22] affecting knowns-dev/knowns version 0.11.4. The flaw resides in the create_doc tool, which accepts a folder name value without proper sanitization. An attacker can supply a crafted folder name containing traversal sequences to access files outside the intended directory. The vulnerability is exploitable over the network without authentication or user interaction, and impacts the confidentiality of the target system.

Critical Impact
Unauthenticated remote attackers can traverse the file system and read arbitrary files by submitting crafted folder name input to the create_doc tool.

Affected Products

knowns-dev/knowns version 0.11.4
The create_doc tool component within the affected release
Deployments exposing the affected tool over network-reachable interfaces

Discovery Timeline

2026-07-21 - CVE-2026-30632 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-30632

Vulnerability Analysis

The vulnerability stems from insufficient input validation in the create_doc tool of knowns-dev/knowns0.11.4. The tool accepts a folder name parameter and uses it to construct a file system path. Because the value is not normalized or restricted to a safe base directory, path traversal sequences such as ../ are interpreted by the underlying file system API. This allows the caller to escape the intended working directory.

Exploitation results in read access to files outside the application's expected scope. According to the CVSS metrics, the flaw impacts confidentiality only, without direct integrity or availability effects. The current EPSS probability sits at 0.659%, indicating limited but non-zero observed exploit interest.

Root Cause

The root cause is missing canonicalization and containment checks on user-supplied folder names. The create_doc tool concatenates or passes attacker-controlled strings directly into path operations. Without resolving the final path and confirming it stays under an allowed root, traversal sequences reach the file system layer. This is a classic instance of CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An attacker sends a request that invokes the create_doc tool with a folder name value containing sequences such as ../../etc or similar traversal payloads. The tool constructs a path that escapes the intended directory. The attacker then reads or references files stored outside the sanctioned document area. No credentials or user interaction are required. Technical proof-of-concept material is referenced in the GitHub Gist Code Example and the fix is available in the GitHub Knowns Commit.

Detection Methods for CVE-2026-30632

Indicators of Compromise

Requests to the create_doc tool endpoint containing ../, ..\, URL-encoded (%2e%2e%2f), or double-encoded traversal sequences in the folder name field.
Application logs referencing file paths that resolve outside the configured document root.
Unexpected read operations against sensitive files such as /etc/passwd, configuration files, or credential stores originating from the knowns process.

Detection Strategies

Inspect application and web server logs for folder name parameters containing traversal patterns or absolute path prefixes.
Deploy web application firewall rules matching path traversal payloads targeting the create_doc route.
Compare the canonicalized resolved path against the expected base directory and alert on mismatches.

Monitoring Recommendations

Monitor file system access telemetry for the knowns process reading files outside its designated data directory.
Alert on outbound responses from the create_doc tool that include content sizes or file signatures inconsistent with document workflows.
Track version metadata across deployments to identify systems still running 0.11.4.

How to Mitigate CVE-2026-30632

Immediate Actions Required

Upgrade knowns-dev/knowns to a release that includes the fix from the upstream patch commit.
Restrict network exposure of the create_doc tool to trusted clients until patching is complete.
Audit stored logs for prior invocations of create_doc containing traversal sequences.

Patch Information

The maintainers have published a fix in the knowns-dev/knowns repository. Review the changes in the GitHub Knowns Commit and upgrade to a version that supersedes 0.11.4. Rebuild and redeploy any container images or packages that bundle the vulnerable release.

Workarounds

Place a reverse proxy or WAF in front of the application to block requests whose folder name parameters contain .., backslashes, or encoded traversal sequences.
Run the knowns service under a restricted user account with file system permissions limited to the document directory.
Enforce mandatory access controls (AppArmor, SELinux) that confine the process to a fixed path prefix.

bash

# Configuration example: reject traversal payloads at the proxy layer
# nginx snippet to block encoded and raw traversal in query/body
location /create_doc {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 400;
    }
    proxy_pass http://knowns_backend;
}