CVE-2026-115353
Description
A flaw was found in mistune. This flaw allows a remote attacker to read arbitrary files and access sensitive system data through a path traversal vulnerability in the reStructuredText (RST) include directive. By submitting crafted markup referencing absolute file paths or directory traversal sequences, an attacker can embed local files into the rendered output.
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker could exploit an application that processes untrusted Markdown with Mistune’s Include directive enabled and a source-file context configured to disclose files readable by the rendering process. This can expose sensitive information, including application credentials. The demonstrated vulnerability does not directly provide arbitrary code execution.
Mitigation
Avoid processing untrusted user-supplied markup using reStructuredText directive extensions that permit file inclusions. If parsing untrusted content is necessary, run the rendering application within an isolated container or sandboxed environment with restricted filesystem read permissions to prevent unauthorized access to sensitive local files.
Caveat: Disabling directive plugins or restricting filesystem access may prevent legitimate document inclusions or referenced resources from rendering properly.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.6 | N/A | 8.6 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
