CVE-2026-86439: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memory` tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (`Get`, `Create`, `Update`, `Rename`, `Delete`) in both `doc_store.go` and `memory_store.go` concatenate user-controlled paths with `filepath.Join()` without any containment validation. Additionally, the `docs.update` action with a `newPath` parameter performs a file deletion via `Rename()`, but is classified as `CapWrite` in the permission registry rather than `CapDelete`. This allows an attacker with a `read-write-no-delete` preset to bypass deletion restrictions and destroy arbitrary files outside the project root. ## Affected paths | File Path | Role | Vulnerability & Execution Impact | | :--- | :--- | :--- | | **`internal/storage/doc_store.go`** | Vulnerable Sink (Docs) | **Path Traversal in File Operations (CWE-22):** `Get()`, `Create()`, `Update()`, `Rename()`, `Delete()` join user-controlled `path` with `filepath.Join(ds.docsDir(), ...)` without validating path containment. | | **`internal/storage/memory_store.go`** | Vulnerable Sink (Memory) | **Path Traversal in Memory Operations (CWE-22):** `GetInLayer()`, `Create()`, `Update()`, `Delete()` join user-controlled `id` with `filepath.Join(dir, models.MemoryFileName(id))` without validation. | | **`internal/mcp/handlers/doc.go`** | Pass-Through Handler | **Unsanitized Input Propagation:** MCP handlers pass user-supplied `path`, `folder`, `newPath` directly to storage layer without sanitization. | | **`internal/mcp/handlers/memory.go`** | Pass-Through Handler | **Unsanitized Input Propagation:** MCP handlers pass user-supplied `id` directly to storage layer without sanitization. | | **`internal/permissions/registry.go`** | Authorization Bypass | **Capability Misclassification (CWE-863):** `docs.update` with `newPath` performs file deletion but is classified as `CapWrite`, bypassing `CapDelete` restrictions. | ## Root Cause ### Missing Path Containment in DocStore In `internal/storage/doc_store.go`, all file operations use `filepath.Join()` to construct absolute paths without validating that the resolved path remains within `docsDir()`: ```go // Get retrieves a doc by its relative path (without .md extension). func (ds *DocStore) Get(path string) (*models.Doc, error) { path = strings.TrimPrefix(path, "/") path = strings.TrimSuffix(path, ".md") // VULNERABLE: No containment check absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+".md") if _, err := os.Stat(absPath); err == nil { // ... return ds.parseFile(absPath, path, folder, false, "") } // ... } // Create writes a new doc to .knowns/docs/{path}.md. func (ds *DocStore) Create(doc *models.Doc) error { if doc.Path == "" { return fmt.Errorf("doc path is required") } // VULNERABLE: No containment check absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") if err := os.MkdirAll(filepath.Dir(absPath), 0755); err != nil { return fmt.Errorf("create doc dir: %w", err) } return ds.writeFile(absPath, doc) } // Rename rewrites a doc to a new path and removes the old file. func (ds *DocStore) Rename(oldPath string, doc *models.Doc) error { // ... oldAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(oldPath, ".md"))+".md") newAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(doc.Path, ".md"))+".md") // ... if err := ds.writeFile(newAbsPath, doc); err != nil { return err } if oldAbsPath != newAbsPath { // VULNERABLE: Deletes file at oldAbsPath (can be outside docsDir) if err := os.Remove(oldAbsPath); err != nil && !os.IsNotExist(err) { return err } } return nil } // Delete removes a doc file. func (ds *DocStore) Delete(path string) error { path = strings.TrimSuffix(path, ".md") // VULNERABLE: No containment check absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+".md") return os.Remove(absPath) } ``` **Critical Flaws:** - `filepath.Join` resolves `../` sequences natively - No post-Join prefix check (e.g., `strings.HasPrefix(absPath, ds.docsDir())`) - No rejection of absolute paths or path traversal sequences - `Rename()` performs file deletion via `os.Remove(oldAbsPath)`, which can target files outside the docs directory ### Missing Path Containment in MemoryStore In `internal/storage/memory_store.go`, memory operations similarly lack path validation: ```go // GetInLayer retrieves a memory entry by ID from a specific layer only. func (ms *MemoryStore) GetInLayer(id, layer string) (*models.MemoryEntry, error) { // ... dir, err := ms.dirForLayer(layer) if err != nil { return nil, err } // VULNERABLE: No containment check for id containing "../" absPath := filepath.Join(dir, models.MemoryFileName(id)) if _, err := os.Stat(absPath); err != nil { return nil, fmt.Errorf("memory %q not found in %s layer", id, layer) } return ms.parseFile(absPath, layer) } // Create writes a new memory entry to the appropriate layer directory. func (ms *MemoryStore) Create(entry *models.MemoryEntry) error { // ... dir, err := ms.dirForLayer(entry.Layer) if err != nil { return err } if err := os.MkdirAll(dir, 0755); err != nil { return fmt.Errorf("create memory dir: %w", err) } // VULNERABLE: No containment check for entry.ID containing "../" absPath := filepath.Join(dir, models.MemoryFileName(entry.ID)) return atomicWrite(absPath, []byte(renderMemory(entry))) } // Delete removes a memory entry by ID. func (ms *MemoryStore) Delete(id string) error { // ... filename := models.MemoryFileName(id) dirs := []string{ms.projectDir(), ms.globalDir()} for _, dir := range dirs { // VULNERABLE: No containment check absPath := filepath.Join(dir, filename) if _, err := os.Stat(absPath); err == nil { return os.Remove(absPath) } } return fmt.Errorf("memory %q not found", id) } ``` ### Authorization Bypass via Rename-as-Delete In `internal/mcp/handlers/doc.go`, the `handleDocUpdate()` function accepts a `newPath` parameter that triggers a rename operation: ```go func handleDocUpdate(getStore func() *storage.Store, req mcp.CallToolRequest) (*mcp.CallToolResult, error) { // ... if v, ok := stringArg(args, "newPath"); ok && strings.TrimSpace(v) != "" { doc.Path = strings.Trim(strings.TrimSuffix(v, ".md"), "/") } // ... if oldPath != doc.Path { if err := store.Docs.Rename(oldPath, doc); err != nil { return errFailed("rename doc", err) } // ... } // ... } ``` The `Rename()` function in `doc_store.go` performs file deletion: ```go if oldAbsPath != newAbsPath { if err := os.Remove(oldAbsPath); err != nil && !os.IsNotExist(err) { return err } } ``` However, in `internal/permissions/registry.go`, `docs.update` is classified as `CapWrite`: ```go "docs.update": {Capability: CapWrite, Target: TargetDoc, Risk: RiskMedium}, ``` This allows an attacker with a `read-write-no-delete` preset (which permits `CapWrite` but denies `CapDelete`) to delete files by using `docs.update` with a `newPath` parameter. ## Attack Vector | Phase | Request / Action | Effect | | :--- | :--- | :--- | | **1. Arbitrary File Read** | `docs.get` with `path="../../../victim/secret"` | Server reads file outside project root via path traversal in `DocStore.Get()`. | | **2. Arbitrary File Write** | `docs.create` with `folder="../../../victim"` | Server writes file outside project root via path traversal in `DocStore.Create()`. | | **3. Arbitrary File Delete** | `docs.update` with `path="../outside/secret.md"` and `newPath="../../../victim/renamed.md"` | Server deletes file outside project root via path traversal in `DocStore.Rename()`. Bypasses `CapDelete` restriction because `docs.update` is classified as `CapWrite`. | | **4. Memory File Read/Write** | `memory.update` with `id="x/../../../../victim/secret"` | Server reads and overwrites file outside project root via path traversal in `MemoryStore.Update()`. | ## Analysis ### Classic Path Traversal Pattern Both `DocStore` and `MemoryStore` follow the same vulnerable pattern: user-controlled input is concatenated with a base directory using `filepath.Join()`, then passed directly to file system operations (`os.ReadFile`, `os.WriteFile`, `os.Remove`, `os.Stat`) without any validation. ```go absPath := filepath.Join(baseDir, filepath.FromSlash(userInput)) // No containment check: strings.HasPrefix(absPath, baseDir) // No rejection of ".." or absolute paths ``` `filepath.Join` resolves `../` sequences, allowing attackers to escape the intended directory: - Input: `"../../../etc/passwd"` - Result: `/project/.knowns/docs/../../../etc/passwd` → `/etc/passwd` ### Rename-as-Delete Authorization Bypass The `Rename()` function performs two operations: 1. Write the file to the new location (`newAbsPath`) 2. Delete the file from the old location (`oldAbsPath`) Both paths are vulnerable to traversal. An attacker can: - Set `path` to a file outside the project (e.g., `"../../../victim/target.md"`) - Set `newPath` to another location outside the project - The `Rename()` function will delete the file at `path` (outside the project) Because `docs.update` is classified as `CapWrite` rather than `CapDelete`, this operation bypasses deletion restrictions in `read-write-no-delete` presets. ### Compounding Factor - Unauthenticated Access Due to the previously identified **Auth Bypass** vulnerability, all MCP tools are accessible without credentials when the server is started without a password, making this a zero-credential attack. ## Fix *Patch is available right now at [New Release](https://github.com/knowns-dev/knowns/releases).*