Bug 2559366 (CVE-2026-115355)
| Summary: | CVE-2026-115355 mistune: mistune: Arbitrary file read via path traversal in Include directive | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, sghai, sidsharm, suppawar, vlaad |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Mistune. A remote attacker can exploit a path traversal vulnerability in the Include directive by supplying manipulated file paths to access and read arbitrary files on the system. Furthermore, an attacker can inject malicious content through unescaped error messages and included files, potentially leading to cross-site scripting (XSS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2560080, 2560081, 2560082, 2560083, 2560084, 2560086, 2560087 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-22 20:54:04 UTC
|