{"id":"CVE-2026-115354","kind":"vulnerability","aliases":["CVE-2026-115354"],"related":[],"title":"Mistune: Include directive path traversal reads local files from Markdown","description":"Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.","summary":"Mistune before 3.3.0 has a path traversal flaw in its opt-in Include directive that lets relative or absolute include paths reach local files. An attacker who submits Markdown rendered through Markdown.read() can read files such as /etc/passwd and inject unescaped HTML or script into the output.","severity":"high","cvss":7.1,"epss":0.00333,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["markdown-rendering","mistune","package","python","self-hosted"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- Check the installed version with `pip show mistune` or `python -c \"import mistune; print(mistune.__version__)\"`\n- Search your code for the Include directive being enabled, for example `include` plugin or directive registration in Mistune setup\n- Search your code for `Markdown.read(` calls that render user-submitted Markdown","fix":"- Upgrade mistune to `3.3.0` or later with `pip install --upgrade \"mistune>=3.3.0\"`\n- Leave the Include directive disabled for untrusted input until upgraded","status":"open","published_at":"2026-10-22T19:17:41+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:31:30+00:00","updated_at":"2026-10-25T03:31:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade mistune to `3.3.0` or later with `pip install --upgrade \"mistune>=3.3.0\"`\n- Leave the Include directive disabled for untrusted input until upgraded","reach":"internet","title":"Mistune: Include directive path traversal reads local files from Markdown","impact":"high","summary":"Mistune before 3.3.0 has a path traversal flaw in its opt-in Include directive that lets relative or absolute include paths reach local files. An attacker who submits Markdown rendered through Markdown.read() can read files such as /etc/passwd and inject unescaped HTML or script into the output.","category":"package","nicknames":[],"who_cares":["python","mistune","markdown-rendering","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server local files readable and script injected into rendered pages","analyst_note":"Confirm the exact affected version range and whether the Include directive is enabled by default; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115354 should state the fixed version.","how_to_check":"- Check the installed version with `pip show mistune` or `python -c \"import mistune; print(mistune.__version__)\"`\n- Search your code for the Include directive being enabled, for example `include` plugin or directive registration in Mistune setup\n- Search your code for `Markdown.read(` calls that render user-submitted Markdown","needs_analyst":true,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Applications that use Mistune 3.x before 3.3.0 with the opt-in Include directive turned on and that render Markdown from users or other untrusted sources through Markdown.read(). Systems that only render trusted, internally authored Markdown, or that keep the Include directive off, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":3373,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115354':13A,16A '-2026':12A,15A '/etc/passwd':64B,115C '3.3.0':28B,76C 'absolut':45B,100C 'allow':90C 'attack':52B,91C,103C 'contain':77C 'content':122C 'cve':11A,14A 'direct':3A,40B,88C 'disclos':111C 'file':8A,50B,61B,95C,112C 'flaw':33B 'host':25B 'html':68B,119C 'includ':2A,39B,46B,87C,101C 'inject':66B,117C 'let':42B 'local':7A,49B,94C 'markdown':10A,18B,55B,106C 'markdown-rend':17B 'markdown.read':58B,109C 'mistun':1A,20B,26B,74C 'opt':37B,85C 'opt-in':36B,84C 'output':73B,125C 'packag':21B 'path':4A,31B,47B,79C,102C 'python':22B 'reach':48B 'read':6A,60B,93C 'relat':43B,98C 'render':19B,56B,107C,124C 'script':70B,121C 'self':24B 'self-host':23B 'submit':54B,105C 'suppli':97C 'travers':5A,32B,80C 'unescap':67B,118C 'via':108C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Mistune 3.x before 3.3.0 with the opt-in Include directive turned on and that render Markdown from users or other untrusted sources through Markdown.read(). Systems that only render trusted, internally authored Markdown, or that keep the Include directive off, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115354","severity":null,"published_at":"2026-10-22T19:17:41+00:00","modified_at":"2026-10-22T19:17:41+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115354","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115354","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}