CVE-2026-59924CWE-22

Mistune: Arbitrary File Read via Include directive path traversal

Medium · published July 8, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-08T16:22Z
EPSS history
Timeline
  • 08 JUL 16:22Z
    Mistune: Arbitrary File Read via Include directive path traversal
    cvelistv5