CVE-2026-115353: Mistune before 3.3.0 Path Traversal via include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mistuneto a version that resolves this vulnerability.Fixed in 3.4.0-1
Event History
Frequently Asked Questions
Which Mistune versions are affected?
Mistune versions before 3.3.0 are affected.
What attacker capability is needed to exploit this issue?
An attacker needs to be able to submit Markdown that is rendered with support for the RST include directive. They can reference files using relative traversal sequences such as ../ or absolute paths.
Which deployments are realistically exposed?
Deployments that render attacker-controlled Markdown and process include directives are exposed to arbitrary local file disclosure. The disclosed content may include credentials or environment data embedded in the rendered HTML.