CVE-2026-120325 | Webpro-nl Knip up to 6.44.0 Workspace IssueFixer.ts writeFile workspaces path traversal

A vulnerability labeled as critical has been found in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal.

This vulnerability is documented as CVE-2026-120325. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More