جزئیات آسیب‌پذیری
CVE-2026-120325
Webpro-nl Knip
Webpro-nl Knip Workspace IssueFixer.ts writeFile path traversal
CVSS 4.0
5.3متوسط
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 5.3متوسط | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| 6.3متوسط | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C |
| 6.3متوسط | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C |
| 7.5بالا | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Webpro-nl | Knip | 6.0 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.1 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.10 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.11 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.12 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.13 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.14 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.15 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.16 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.17 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.18 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.19 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.2 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.20 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.21 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.22 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.23 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.24 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.25 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.26 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.27 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.28 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.29 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.3 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.30 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.31 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.32 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.33 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.34 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.35 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.36 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.37 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.38 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.39 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.4 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.40 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.41 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.42 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.43 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.44.0 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.5 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.6 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.7 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.8 | CVEProject cvelistV5 (CNA) |
| Webpro-nl | Knip | 6.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۵- https://vuldb.com/vuln/429657 vdb-entrytechnical-description
- https://vuldb.com/vuln/429657/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-120325 third-party-advisory
- https://vuldb.com/submit/1015033 third-party-advisory
- https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md exploit
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۱
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۱
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- VulDB
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۴۷٪
احتمال بهره‌برداری در ۳۰ روز
۴۰٫۶٪
صدک (نسبت به همه‌ی CVEها)
ضعف‌ها (CWE)
- CWE-22Path Traversal