CVE-2026-86439: CVE-2026-86439: Path Traversal Vulnerability in knowns MCP Document and Memory Storage

#security #cve #cybersecurity

CVE-2026-86439: Path Traversal Vulnerability in knowns MCP Document and Memory Storage

Vulnerability ID: CVE-2026-86439
CVSS Score: 8.8
Published: 2026-09-25

A critical path traversal vulnerability (CWE-22) exists in knowns prior to version 0.30.0. The software fails to restrict file path arguments passed to Model Context Protocol (MCP) tools, permitting low-privilege users to escape the designated base storage directories and manipulate arbitrary markdown files on the host filesystem.

TL;DR

Unsafe path resolution in knowns < 0.30.0 allows remote users with low privileges to read, write, and delete arbitrary markdown files on the server.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Secondary CWE ID: CWE-863
Attack Vector: Network
CVSS v3.1 Score: 8.8
EPSS Score: 0.01079 (1.08%)
Exploit Status: Proof of Concept Available
CISA KEV Status: Not Listed

Affected Systems

knowns prior to version 0.30.0
knowns: < 0.30.0 (Fixed in: 0.30.0)

Code Analysis

Commit: 09c5a96

Fix path traversal in document and memory storage routines by implementing safepath resolution logic

Mitigation Strategies

Upgrade to version 0.30.0 or higher immediately.
Run the knowns service under a highly restricted system user account.
Apply network-level restriction controls to block unauthorized MCP endpoint queries.

Remediation Steps:

Identify active installations of the knowns service running versions prior to 0.30.0.
Pull the patched version 0.30.0 from official distribution repositories.
Review filesystem configurations to restrict read/write access of the knowns process to the local directory only.
Deploy network firewalls or load balancers to restrict access to the MCP server.

References

Read the full report for CVE-2026-86439 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community