Path Traversal Vulnerability in Mistune by Lepture

CVE-2026-115354

What is CVE-2026-115354?

Mistune versions prior to 3.3.0 exhibit a vulnerability allowing path traversal via the opt-in Include directive. This flaw permits attackers to disclose sensitive local files by providing relative or absolute paths in Markdown content submitted through Markdown.read(). Exploiting this vulnerability can lead to the unintended exposure of files such as /etc/passwd and may enable the injection of unescaped HTML or script content into the rendered output, posing significant risks to the security of applications utilizing the Mistune library.

References