Description

knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {"path": "../../../../tmp/knowns_pwn_marker"} to POST /api/docs, or an encoded path to GET /api/docs/...) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects' documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-09T14:17:28.533Z",
  "pubdate": "2026-09-09T14:17:28.533Z",
  "executiveSummary": "A critical path traversal vulnerability exists in the npm package knowns in versions up to and including 0.29.1. The vulnerability is located within the Document API handler and allows remote, unauthenticated attackers to perform arbitrary file operations on the host filesystem.\nIn default deployments, the Management API is unauthenticated and bound to all network interfaces, exposing the vulnerable endpoint to external actors. By sending crafted directory traversal sequences, an attacker can read, create, overwrite, or delete arbitrary files with a .md extension, as well as create arbitrary directories.\nThe implications of this security flaw are severe, ranging from the exposure of sensitive documentation and project data to file corruption. Furthermore, the ability to write arbitrary files can serve as a primitive that attackers may chain with other system behaviors to achieve remote code execution (RCE) on the host system. This vulnerability presents a high risk to deployments where the application is accessible over the network without network-level restrictions, enabling complete compromise of data integrity and confidentiality on the affected host.",
  "technicalDetails": "The root cause of this path traversal vulnerability lies in the improper validation and normalization of user-supplied paths within the Document API component of the knowns package.\nThe attack surface is exposed via the HTTP handler defined in internal/server/routes/docs.go. When a request is received, the handler processes the user-supplied document path using a normalization helper function called cleanDocPath(). This function is designed to strip leading and trailing slashes and remove the '.md' suffix from the input. However, cleanDocPath() does not perform any validation, filtering, or neutralization of directory traversal sequences, specifically the '../' pattern.\nFollowing this initial normalization step, the control flow transitions to internal/storage/doc_store.go, which is responsible for building the final filesystem path of the target document. The application constructs this path by executing the following operation: filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+\".md\"). Although filepath.Join cleans the resulting path by resolving relative segments, it does not verify whether the final, absolute resolved path remains confined within the boundaries of the designated documents directory (ds.docsDir()). As a result, the inclusion of directory traversal characters in the input allows the path resolution to escape the root storage directory entirely.\nAn attacker can exploit this behavior through multiple vectors depending on the HTTP method utilized. To write or overwrite files, an attacker can issue a POST request to the /api/docs endpoint with a JSON payload containing a traversal path, such as {\"path\": \"../../../../tmp/knowns_pwn_marker\"}. Upon receiving this payload, the backend processes the path, resolves it to an external directory, and calls os.MkdirAll to create any missing parent directories, thereby granting the attacker an arbitrary directory creation primitive. The application then writes the content to the resolved location with a '.md' extension appended.\nTo read arbitrary files, the attacker can construct a GET request to the /api/docs/... endpoint, providing an encoded traversal path. The server processes this request, bypasses the intended directory restriction, and retrieves the file content from the host filesystem, provided the file ends with a '.md' extension.\nBecause the Management API is bound to all network interfaces and lacks authentication by default, any remote attacker with network access to the application can perform these operations. While the write primitive is constrained to appending '.md' to the created files, this behavior still allows for significant data tampering, denial of service via file corruption, or potential code execution if the attacker can write to directories parsed by other executable services on the system."
}