An unauthenticated directory traversal vulnerability in the knowns API allows remote attackers to perform unauthorized file operations on the host system, posing a critical security risk.

The vulnerability exists in the /api/opencode proxy endpoint, where the application fails to sanitize the x-opencode-directory request header. This flaw allows an unauthenticated attacker to manipulate file paths and execute operations outside the intended project root directory.

Successful exploitation of this vulnerability grants an attacker the ability to read, modify, or delete sensitive files on the host system, depending on the permissions of the process running the application. With a CVSS score of 9.8, this flaw represents a critical risk that could lead to full system compromise, unauthorized data exposure, and significant service disruption.

Immediate Action: Update the knowns software to version 0.31.0 or later immediately to incorporate the necessary validation logic for the request header.

Proactive Monitoring: Review web server and application access logs for anomalous requests containing path traversal patterns or unexpected directory references in the x-opencode-directory header.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block requests containing directory traversal sequences or suspicious headers directed at the /api/opencode endpoint.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the ease of exploitation through unauthenticated network requests, organizations must prioritize patching. Administrators should verify the current version of knowns in their environment and apply the 0.31.0 update as the primary method of remediation to prevent potential system-wide compromise.