CVE-2026-30633 Details

A directory traversal vulnerability has been identified in the knowns documentation management tool, specifically in version 0.11.4. The issue arises in the 'get_doc' and 'update_doc' tools, where crafted path values can be used to traverse directories and access or modify files outside the intended directory. The vulnerability allows reading and overwriting of markdown files, but is limited to files with a '.md' extension.

To address this vulnerability, validate the 'path' parameter in the 'resolveDocPath()' function to prevent directory traversal. Ensure that the resolved path remains within the allowed documentation directory and reject any path components containing '..' as an additional precaution.