CVE-2026-115354Medium· 6.5▾ SunlitA flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown inp…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
0.3%
A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown input can exploit this flaw to read arbitrary local files from the server and inject unescaped content into the rendered output.
mistune: mistune: Information disclosure via path traversal in Include directive — rated Moderate by Red Hat. Released 2026-10-22, updated 2026-10-23.
Affected:
No fix planned:
Fix deferred
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114109High· 7.8uv: uv: Arbitrary code execution via path traversal in entry point names (CVE-2026-114109)
CVE-2026-109956High· 7.0NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths
CVE-2026-109156Medium· 6.3A vulnerability has been found in SeldonIO MLServer up to 1.6.1
CVE-2026-78679Medium· 6.5GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard
CVE-2026-73619Medium· 6.5gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)