Arbitrary file inclusion with the pymdowm-snippets extension

CVE-2023-32309

What is CVE-2023-32309?

PyMdown Extensions, an extension for the Python-Markdown project, contains a vulnerability that allows arbitrary file reads due to improper handling of include file syntax. This issue arises when the Snippets extension incorrectly processes the specified base path, permitting attackers to read sensitive files such as /etc/passwd or /proc/self/environ. If this functionality is mistakenly enabled for user-facing content, there is a risk of exposing confidential information. The vulnerability is addressed in version 10.0, and users are advised to upgrade immediately or implement strict input filtering to restrict relative path access.

References