{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/khoj-2.0.0-beta.23---2.0.0-beta.24/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["khoj (2.0.0-beta.23 - 2.0.0-beta.24)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","path-traversal","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["Khoj"],"content_html":"\u003cp\u003eThe Khoj application contains an unauthenticated path traversal vulnerability within the /home/ endpoint, defined in 'src/khoj/routers/web_client.py'. This endpoint is intended to serve static files from a specific directory but fails to perform path normalization or validation before resolving user-supplied input. An attacker can append directory traversal sequences (such as ../) to the URI to escape the intended directory and access sensitive files on the host filesystem. Because the endpoint lacks authentication decorators, exploitation is possible by any unauthenticated attacker with network access to the Khoj instance. This flaw affects Khoj versions from 2.0.0-beta.23 to 2.0.0-beta.25.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify a reachable Khoj instance.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the /home/ endpoint via an HTTP GET request.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious URI containing path traversal sequences (e.g., ../../../etc/passwd).\u003c/li\u003e\n\u003cli\u003eThe application logic in 'web_client.py' concatenates the malicious path to the base directory without validation.\u003c/li\u003e\n\u003cli\u003eThe underlying operating system resolves the traversal sequences to a target file path outside the web directory.\u003c/li\u003e\n\u003cli\u003eThe 'FileResponse' object retrieves the content of the unintended file.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the requested file in the HTTP response body, leading to information disclosure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read any file on the server accessible to the application process. This includes sensitive data such as database credentials, API keys, application secrets (e.g., Django SECRET_KEY), and system-level files like '/etc/passwd' or '/proc/self/environ'. Access to these files can lead to complete service compromise, facilitate further lateral movement, or allow the attacker to gain persistent unauthorized access to the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a version of Khoj patched against this vulnerability (\u0026gt;= 2.0.0-beta.25).\u003c/li\u003e\n\u003cli\u003eImplement a WAF or reverse proxy rule to block or sanitize incoming HTTP requests containing directory traversal sequences (e.g., ../) in the /home/ URI path.\u003c/li\u003e\n\u003cli\u003eApply the suggested code-level patch to 'src/khoj/routers/web_client.py' by adding path resolution and validation logic that verifies the requested file remains within the intended base directory.\u003c/li\u003e\n\u003cli\u003eDeploy the suggested Sigma rule to monitor for suspicious traversal patterns in web server logs.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-26T02:07:27Z","date_published":"2026-09-26T02:07:27Z","id":"https://feed.craftedsignal.io/briefs/2026-09-khoj-path-traversal/","summary":"An unauthenticated path traversal vulnerability in the Khoj /home/ endpoint allows remote attackers to read arbitrary files from the server filesystem.","title":"Unauthenticated Path Traversal in Khoj","url":"https://feed.craftedsignal.io/briefs/2026-09-khoj-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Khoj (2.0.0-Beta.23 - 2.0.0-Beta.24)","version":"https://jsonfeed.org/version/1.1"}