https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 09:31:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291909 EUVD-2026-291909 https://cve.radiocsirt.org/vuln/euvd-2026-291909 https://cve.radiocsirt.org/vuln/fkie_cve-2025-1686 <p>Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of(&#34;include&#34;)) .build()) .build();</p> <p>Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of(&#34;include&#34;)) .build()) .build();</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-1686 https://cve.radiocsirt.org/vuln/ghsa-p75g-cxfj-7wrx <p><strong>Affected:</strong> Maven: io.pebbletemplates:pebble</p> <p>### Summary</p> <p>If untrusted user input is used to dynamically create a `PebbleTemplate` with the method `PebbleEngine#getLiteralTemplate`, then an attacker can include arbitrary local files from the file system into the generated template, leaking potentially sensitive information into the output of `PebbleTemplate#evaluate`. This is done via the `include` macro.</p> <p>### Details</p> <p>The `include` macro calls `PebbleTempateImpl#resolveRelativePath` with the `relativePath` argument passed within the template:</p> <p>Example template: ``` {% include [relativePath] %} ``` When `resolveRelativePath` is called, the `relativePath` is resolved against the `PebbleTemplateImpl.name` variable.</p> <p>```java /** * This method resolves the given relative path based on this template file path. * * @param relativePath the path which should be resolved. * @return the resolved path. */ public String resolveRelativePath(String relativePath) { String resolved = this.engine.getLoader().resolveRelativePath(relativePath, this.name); if (resolved == null) { return relativePath; } else { return resolved; } } ``` https://github.com/PebbleTemplates/pebble/blob/82ad7fcf9e9eaa45ee82ae3335a1409d19c10263/pebble/src/main/java/io/pebbletemplates/pebble/template/PebbleTemplateImpl.java#L380</p> <p>Unfortunately, when the template is created from a string, as is the case when `PebbleEngine#getLiteralTemplate` is used, the `PebbleTemplateImpl.name` variable is actually the entirety of…</p> <p><strong>Affected:</strong> Maven: io.pebbletemplates:pebble</p> <p>### Summary</p> <p>If untrusted user input is used to dynamically create a `PebbleTemplate` with the method `PebbleEngine#getLiteralTemplate`, then an attacker can include arbitrary local files from the file system into the generated template, leaking potentially sensitive information into the output of `PebbleTemplate#evaluate`. This is done via the `include` macro.</p> <p>### Details</p> <p>The `include` macro calls `PebbleTempateImpl#resolveRelativePath` with the `relativePath` argument passed within the template:</p> <p>Example template: ``` {% include [relativePath] %} ``` When `resolveRelativePath` is called, the `relativePath` is resolved against the `PebbleTemplateImpl.name` variable.</p> <p>```java /** * This method resolves the given relative path based on this template file path. * * @param relativePath the path which should be resolved. * @return the resolved path. */ public String resolveRelativePath(String relativePath) { String resolved = this.engine.getLoader().resolveRelativePath(relativePath, this.name); if (resolved == null) { return relativePath; } else { return resolved; } } ``` https://github.com/PebbleTemplates/pebble/blob/82ad7fcf9e9eaa45ee82ae3335a1409d19c10263/pebble/src/main/java/io/pebbletemplates/pebble/template/PebbleTemplateImpl.java#L380</p> <p>Unfortunately, when the template is created from a string, as is the case when `PebbleEngine#getLiteralTemplate` is used, the `PebbleTemplateImpl.name` variable is actually the entirety of…</p> https://cve.radiocsirt.org/vuln/ghsa-p75g-cxfj-7wrx