The knowns npm package versions <= 0.29.1 contain a path traversal vulnerability in the Document API's HTTP handler. The function cleanDocPath() normalizes user-supplied document paths by stripping leading/trailing slashes and the .md suffix but fails to neutralize '../' sequences. The server then constructs file paths without verifying that the final resolved path remains inside the documents directory. In default deployments where the Management API is unauthenticated and exposed, an attacker can supply traversal payloads to read, write, or delete arbitrary .md files anywhere on the host filesystem and create directories. This can lead to exposure of sensitive data, file corruption, or arbitrary write capabilities that may be leveraged for code execution. The issue is resolved in version 0.30.0.

Remote unauthenticated attackers can exploit this vulnerability to read sensitive documentation files, overwrite or delete files with .md extensions anywhere on the host filesystem, and create arbitrary directories. This can lead to data exposure, data corruption, and potentially enable further attacks such as code execution through chaining. The vulnerability affects default deployments where the Management API is unauthenticated and exposed to all interfaces.

Upgrade knowns to version 0.30.0 or later, where this path traversal vulnerability is fixed. Until then, restrict access to the Management API to trusted users and networks to reduce exposure. Patch status is confirmed fixed in version 0.30.0.