CVE-2026-115353: lepture mistune, обхождане на път

Описание

Оригинално описание

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

Засегнати продукти

• lepture mistune: преди 3.3.0; 3.3.0

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в lepture mistune

• 8.7CVE-2026-121437
• 6.9CVE-2026-121438
• 8.7CVE-2026-115355
• 7.1CVE-2026-115354
• 8.7CVE-2026-115352

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-115353
• https://nvd.nist.gov/vuln/detail/CVE-2026-115353
• https://github.com/lepture/mistune/security/advisories/GHSA-9jjx-3hq3-hx4j
• https://www.vulncheck.com/advisories/mistune-before-3.3.0-path-traversal-via-include-directive