CVE-2026-30633: Knowns Path Traversal Vulnerability

CVE-2026-30633 Overview

CVE-2026-30633 is a directory traversal vulnerability in knowns-dev/knowns version 0.11.4. The flaw resides in the get_doc and update_doc tools, which fail to validate the path parameter supplied by callers. A remote attacker can craft a path value containing traversal sequences to read arbitrary files outside the intended document directory. The weakness is classified as [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
An unauthenticated network attacker can read sensitive files on the host by supplying crafted path values to the get_doc and update_doc tools, leading to confidentiality loss.

Affected Products

knowns-dev/knowns version 0.11.4
The get_doc tool endpoint
The update_doc tool endpoint

Discovery Timeline

2026-07-21 - CVE-2026-30633 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-30633

Vulnerability Analysis

The vulnerability affects the document handling tools exposed by knowns-dev/knowns. Both get_doc and update_doc accept a path argument that is used to locate a document on disk. The implementation does not canonicalize or restrict the supplied path to an approved base directory. Attackers can therefore inject relative traversal sequences such as ../ to escape the intended document root.

Because the attack vector is network-based and requires no authentication or user interaction, exploitation can be automated at scale. Successful exploitation exposes file contents on the host filesystem, including configuration files, secrets, and other application data.

The EPSS probability for this CVE is 0.659% as of 2026-07-23. No public exploit or CISA KEV listing has been recorded at this time.

Root Cause

The root cause is missing input sanitization on the path parameter within the get_doc and update_doc handlers. The application concatenates user-supplied path segments with a base directory without resolving the canonical location or enforcing a prefix check. This maps directly to [CWE-22].

Attack Vector

An attacker sends a request to the vulnerable tool interface with a path value containing ../ sequences or absolute path references. The handler resolves the path against the filesystem and returns or writes the target file. No credentials or user interaction are required. Refer to the GitHub Gist proof-of-concept snippet and the upstream commit for technical details.

// No verified exploit code is published for CVE-2026-30633.
// See the linked Gist and commit references for technical details.

Detection Methods for CVE-2026-30633

Indicators of Compromise

Requests to get_doc or update_doc tool endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths such as /etc/passwd.
Access log entries showing document tool calls resolving to files outside the configured document root.
Unexpected read or write activity on sensitive files by the knowns service account.

Detection Strategies

Deploy web application firewall or reverse proxy rules that inspect path parameters submitted to knowns tool endpoints for traversal patterns.
Correlate application audit logs with filesystem telemetry to identify document tool requests that resolve outside the expected base directory.
Alert on the knowns process opening files it does not normally access, such as /etc/, ~/.ssh/, or credential stores.

Monitoring Recommendations

Enable verbose request logging on the knowns service and forward logs to a centralized analytics platform for retrospective review.
Monitor the parent directory of the configured document store for reads and writes originating from the knowns process.
Track outbound data volume from the knowns host to detect bulk file exfiltration following traversal abuse.

How to Mitigate CVE-2026-30633

Immediate Actions Required

Upgrade knowns-dev/knowns beyond version 0.11.4 to a build that includes commit 62fb0daaa0b9e66fce1d42c02b5bb519367cf669.
Restrict network access to the knowns service so only trusted clients can reach the get_doc and update_doc tools.
Run the knowns process under a low-privilege service account with read access limited to the document directory.

Patch Information

The upstream fix is available in commit 62fb0daaa0b9e66fce1d42c02b5bb519367cf669. Apply the patch or upgrade to a released version containing this commit. Validate that the deployed binary or package reflects the fixed revision before returning the service to production.

Workarounds

Place the knowns service behind a reverse proxy that rejects requests containing traversal sequences in the path parameter.
Confine the process using filesystem sandboxing such as chroot, containers with read-only mounts, or Linux namespaces to bound the reachable filesystem.
Disable the get_doc and update_doc tools if they are not required for the deployment.

bash

# Example: block traversal patterns at an nginx reverse proxy
location /tools/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://knowns_backend;
}