Knowns Before 0.30.0 Path Traversal Via Document Api

Back www.vulncheck.com

Knowns Before 0.30.0 Path Traversal Via Document Api

www.vulncheck.com • September 10, 2026

Share: View original

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

GitHub Security Advisory (GHSA-3h35-4jq7-hv45)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Path Traversal Vulnerabilities in Knowns Affecting Multiple Versions Two path traversal vulnerabilities have been identified in the Knowns software. The first vulnerability affects versions before 0.30.0, while the second affects versions 0.33.0 and later. Both vulnerabilities are categorized under CWE-22, which pertains to improper limitations of pathnames. Attackers can exploit these vulnerabilities via the Document API and Template Engine, potentially allowing unauthorized access to sensitive files. The vulnerabilities have been documented in GitHub Security Advisories (GHSA-3h35-4jq7-hv45 and GHSA-68cq-4rwm-f7jr). Users of affected versions are advised to prioritize patching to mitigate risks. No active exploitation has been confirmed as of now, but the vulnerabilities are significant enough to warrant immediate attention. The advisories provide guidance on vulnerability prioritization and early warning systems for ongoing threats. 2 sources 43

Extracted Entities

CWE Weaknesses (1)

CWE-22 - Path Traversal

Vulnerabilities (1)