CVE-2026-115355 — Mistune before 3.3.0 Path Traversal and XSS via Include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. …
Published: 2026-10-22 · CVSS: 8.7 · CVSS 4.0
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7