CVE-2026-115354
CVE-2026-115354 · Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
mistune
- Versions
- ≥ 0, < 3.3.0: Affected (semver)
- 3.3.0: Not affected (semver)
Update to 3.3.0
mistune Debian:12
- Versions
- 2.0.4-1
- 2.0.4-2
- 3.0.2-1
- 3.0.2-2
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:13
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:14
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published