CVE-2026-115353

Deferred Deferred - Pending Action

Path Traversal in Mistune Markdown Parser via RST Include

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-115353

Affected Vendors & Products

Vendor	Product	Version / Range
lepture	mistune	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Mistune before 3.3.0 has a path traversal flaw in the RST include directive. Attackers can exploit this by using markdown with include directives that reference relative or absolute paths like ../ to access arbitrary files on the system. This allows reading sensitive files such as credentials or environment data, which are then embedded in the rendered HTML output.

Detection Guidance

Check if Mistune version is below 3.3.0 by running pip show mistune or pip list | grep mistune. Inspect markdown files for include directives with ../ or absolute paths like /etc/passwd or C:\Windows\win.ini.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files on the server where Mistune is running. Attackers may steal confidential data like passwords, API keys, or configuration files. The rendered HTML output could expose this data to users, compromising security and privacy.

Compliance Impact

This vulnerability can violate compliance requirements under GDPR and HIPAA by exposing personal or protected health information. Unauthorized file access may lead to data breaches, resulting in legal penalties, reputational damage, and loss of trust. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Upgrade Mistune to version 3.3.0 or higher immediately. Review and remove any markdown files containing suspicious include directives referencing sensitive paths.

Hi! I’m here to help you understand CVE-2026-115353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70