An unauthenticated directory traversal vulnerability in knowns-dev knowns version 0.11.4 permits remote attackers to read arbitrary files, presenting a high risk to data confidentiality.

This flaw is a directory traversal vulnerability occurring within the create_doc tool, allowing unauthenticated remote attackers to supply crafted folder names and access restricted files via network vectors.

A successful exploit compromises data confidentiality by granting unauthorized read access to sensitive system files. Given the CVSS score of 7.5, organizations face significant risk regarding data exposure, intellectual property theft, and potential regulatory compliance violations if internal documents are disclosed.

Immediate Action: Apply the upstream fix commit available in the official repository or migrate away from version 0.11.4 until an official patched release is deployed.

Proactive Monitoring: Monitor network access logs for suspicious requests targeting the create_doc tool, particularly those containing directory traversal sequences like dot-dot-slash patterns.

Compensating Controls: Deploy a Web Application Firewall rule to inspect input parameters supplied to the create_doc function and block requests containing directory traversal patterns.

Public Exploit Available: No

This high severity vulnerability requires prompt attention due to the absence of authentication requirements for exploitation. Administrators must review the repository for the referenced commit and apply updates immediately to secure sensitive file assets.