Bug 2559281 (CVE-2026-115353) - CVE-2026-115353 mistune: Mistune before 3.3.0 Path Traversal via include Directive
Summary: CVE-2026-115353 mistune: Mistune before 3.3.0 Path Traversal via include Dire...
Keywords:
Status: NEW
Alias: CVE-2026-115353
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2562700 2562701 2562702 2562703 2562707
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-22 20:05 UTC by OSIDB Bzimport
Modified: 2026-10-28 17:47 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-22 20:05:52 UTC 
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.
Note You need to log in before you can comment on or make changes to this bug.