Description (CNA)
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| lepture / mistune | affected 0 before 3.3.0; unaffected 3.3.0 |
CWE
CWE-22