CVE-2026-30632 Details
Description
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool.
A directory traversal vulnerability exists in the Known's documentation management tool, specifically in version 0.11.4. The issue arises when the 'folder' parameter is not properly sanitized, allowing attackers to manipulate the directory path and write files outside the intended directory. This vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
To address this vulnerability, validate the 'folder' parameter by resolving the full path and ensuring it remains within the designated base directory. Reject any path components containing '..' as an additional precaution. Apply the same validation to similar parameters in other documentation-related tools and implement regression tests for path traversal payloads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/spdc-elm/b059904a9e351afc1f5d38351f8b9ea5 | CISA-ADP | ExploitTechnical Description |
| https://gist.github.com/spdc-elm/b059904a9e351afc1f5d38351f8b9ea5 | [email protected] | ExploitTechnical Description |
| https://github.com/knowns-dev/knowns/commit/62fb0daaa0b9e66fce1d42c02b5bb519367cf669 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| knowns-dev knowns | <= 0.11.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |