CVE-2026-120325
Medium · 6.3CVSS
6.3
EPSS
0.5%
Published
Nov 2, 2026
CISA due date
—
The record
A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-108327 Tanium addressed a path traversal vulnerability in Tanium Data Service. CWE-22
- CVE-2026-121542 In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may… CWE-22
- CVE-2026-63502 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics… CWE-22
- CVE-2026-63478 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-22
- CVE-2026-63500 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics… CWE-22
- CVE-2026-63395 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-22
- CVE-2026-63436 zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. CWE-22
- CVE-2026-121263 A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. CWE-22