This vulnerability is a classic path traversal flaw in the MCP argument handling of knowns. The server fails to validate filesystem paths supplied to the MCP tool, allowing an attacker to supply directory traversal sequences that lead to reading, creating, overwriting, or deleting files outside the intended project directory. The flaw can be used to expose arbitrary Markdown files that the server process can reach, potentially revealing sensitive data or code. The weakness is classified as CWE-22.

The affected product is knowns, specifically knowns-dev:knowns versions prior to 0.30.0, including 0.29.1. The issue exists in the internal storage layers that handle document and memory storage. Releases starting with 0.30.0 contain the path validation fix and are not vulnerable.

The flaw has a CVSS score of 8.7, indicating severe impact on confidentiality and integrity of files outside the project directory. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at this time. The description states that attackers can supply path arguments containing directory traversal sequences to the MCP doc or memory tools. However, it does not specify whether the services are exposed to remote networks. Consequently, the attack vector is inferred to be local or remote depending on the exposure of those interfaces; any user—authenticated or unauthenticated—who can invoke the MCP tool with arbitrary paths could read, create, overwrite, or delete files beyond the intended scope.