Cloudanix VulnDB

CVE-2026-115355

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a popular text processing library lets attackers read private files on the server and trick users into running malicious code in their browsers.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Path traversal in the Include directive permits reading arbitrary files via ../ sequences; unescaped error messages and file contents also enable HTML injection leading to XSS despite escape=True.

Why it matters to the business

Attackers can steal sensitive configuration files, source code, or credentials and execute cross-site scripting attacks that compromise user sessions or deliver malware, increasing risk of data breaches and service disruption.

How an attack unfolds

An unauthenticated remote attacker crafts requests containing directory traversal sequences in include directives or supplies malicious content that triggers unescaped output, directly accessing restricted files and injecting scripts into rendered pages.

How to fix it

Upgrade Mistune to version 3.3.0 or later; review and restrict template include usage; enable output escaping where possible and validate all include paths server-side.

How to confirm the fix worked

Confirm Mistune version is 3.3.0 or newer; test include paths with traversal sequences and verify that attempts are rejected or sanitized; scan rendered output for unexpected HTML injection.

Typical attack path

  1. Identify endpoints or templates that invoke the Include directive
  2. Supply crafted include paths containing ../ sequences to traverse directories
  3. Read target file contents returned in responses or errors
  4. Optionally inject HTML payloads via error messages or included files to achieve XSS

How to detect it

Search web server and application logs for requests containing ../ sequences targeting include-related parameters; inspect rendered pages for unexpected script tags or error output containing file paths; review any recent file access anomalies tied to the application process.

  • ../
  • ..%2f
  • ..%5c
  • include path
  • Mistune error

What your security team should do

  • Immediately inventory all deployments using Mistune and schedule upgrades to 3.3.0 within the next 7 days
  • Add WAF rules to block requests containing ../ in parameters that may reach include logic
  • Monitor application logs for unusual file access patterns or error messages containing traversal sequences

The record

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities