The vulnerability is a directory traversal flaw that occurs when the knowns create_doc tool processes a crafted folder name value. An attacker who can supply this input can manipulate the file system path used during document creation, potentially allowing read or write access to files outside the intended working directory. The weakness is correctly classified as CWE-22 and could compromise confidentiality and integrity if exploited.

Knowns‑dev\u2013knowns version 0.11.4 is affected; no other vendors or product versions are currently listed.

The CVSS base score of 7.5 marks the issue as high severity, but the EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not present in the CISA KEV catalog, so no confirmed public exploits exist at present. Based on the description, the crafted folder name is processed by the create_doc tool, implying that the attack requires the ability to influence the input—this could be via local execution or through a remote interface if the tool is exposed. The traversal nature of the issue means that, should an attacker gain entrance, they could read or modify arbitrary files relative to the tool’s working directory.