CVE-2026-30633 describes a directory traversal vulnerability in knowns-dev/knowns version 0.11.4. The flaw is triggered by specially crafted path inputs to the get_doc and update_doc tools, enabling attackers to access files outside the designated directory structure. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 7.5, indicating high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to read arbitrary files on the affected system, potentially exposing sensitive information. The integrity and availability of the system are not impacted according to the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the get_doc and update_doc tools, implementing input validation or filtering on path parameters, and limiting file system permissions to reduce exposure.