MEDIUM 6.9 NVD
CVE-2026-88940
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further exploitation.
References
- https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/server/routes/workspace.go#L42-
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-h73x-698r-qrvg
- https://www.vulncheck.com/advisories/knowns-through-0.33.0-arbitrary-directory-enumeration
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-h73x-698r-qrvg
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-09-10 via NVD.
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.