A path traversal vulnerability in Knowns versions before 0.30.0 allows authenticated attackers to read, create, overwrite, or delete arbitrary files on the host system.

The application fails to properly validate filesystem paths within Model Context Protocol (MCP) tool arguments, which allows an authenticated attacker to use directory traversal sequences to escape the intended project directory and interact with sensitive files accessible to the server process.

Successful exploitation of this vulnerability poses a severe risk to system integrity and confidentiality. By manipulating file paths, an attacker could exfiltrate sensitive configuration data, inject malicious code into application files, or perform denial of service by deleting critical system components. With a CVSS score of 8.8, this flaw is categorized as High severity and requires immediate attention to prevent unauthorized system access or data compromise.

Immediate Action: Update the Knowns software to version 0.30.0 or later, which includes the necessary path validation fixes to prevent directory traversal.

Proactive Monitoring: Review system and application logs for unusual file access patterns or attempts to reference directories outside of the designated project structure.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent input filtering mechanism to detect and block requests containing directory traversal sequences, such as dot-dot-slash patterns.

Public Exploit Available: Unknown

The ability to perform unauthorized file operations via directory traversal represents a critical security oversight in the affected software. Administrators should prioritize the update to version 0.30.0 immediately to remediate the underlying logic error. Failure to patch this vulnerability leaves the server environment exposed to potential compromise by any authenticated user.