CVE-2026-120325 Details
Description
A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A path traversal vulnerability has been identified in Webpro Knip versions through 6.44.0. The issue arises in the Workspace Handler component, specifically within the writeFile function of IssueFixer.ts. The vulnerability allows for manipulation of the workspaces argument, leading to unauthorized access and modification of files outside the intended directory. This path traversal can be exploited remotely, with the potential for significant impact on the victim's file system.
To address this vulnerability, validate workspace paths to ensure they remain within the project's root directory before processing them. Additionally, implement checks in the IssueFixer component to prevent file operations on paths that escape the repository boundary.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-120325 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015033 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429657 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429657/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Webpro-nl Knip | <= 6.39.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |