CVE-2026-88940 — knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host files…
Published: 2026-09-10 · CVSS: 6.9 · CVSS 4.0
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further exploitation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7