{"id":"CVE-2026-115354","title":"mistune: mistune: Information disclosure via path traversal in Include directive (CVE-2026-115354)","summary":"A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown inp…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["openshift_ai_rhoai","openshift_container_platform 4"],"published":"2026-10-22","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:22:51+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115354.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115354.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115354"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559342"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115354"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115354"},{"url":"https://github.com/lepture/mistune/security/advisories/GHSA-jhcm-5rpf-j3wv"},{"url":"https://www.vulncheck.com/advisories/mistune-before-3.3.0-arbitrary-local-file-read-via-include-directive"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-22T22:00:50.396Z","epss":0.00333,"epssPercentile":0.26423,"slug":"CVE-2026-115354","body":"## Overview\n\nA flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown input can exploit this flaw to read arbitrary local files from the server and inject unescaped content into the rendered output.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115354.json)\n\n**mistune: mistune: Information disclosure via path traversal in Include directive** — rated Moderate by Red Hat. Released 2026-10-22, updated 2026-10-23.\n\nAffected:\n\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}