---
id: CVE-2026-115354
title: >-
  mistune: mistune: Information disclosure via path traversal in Include
  directive (CVE-2026-115354)
summary: >-
  A flaw was found in mistune. When the opt-in Include directive is enabled,
  insufficient path validation allows an attacker to perform path traversal by
  supplying relative or absolute file paths. An attacker who submits crafted
  Markdown inp…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - openshift_ai_rhoai
  - openshift_container_platform 4
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T00:22:51+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115354.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115354.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115354'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559342'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115354'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115354'
  - url: 'https://github.com/lepture/mistune/security/advisories/GHSA-jhcm-5rpf-j3wv'
  - url: >-
      https://www.vulncheck.com/advisories/mistune-before-3.3.0-arbitrary-local-file-read-via-include-directive
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-22T22:00:50.396Z'
---

## Overview

A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown input can exploit this flaw to read arbitrary local files from the server and inject unescaped content into the rendered output.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115354.json)

**mistune: mistune: Information disclosure via path traversal in Include directive** — rated Moderate by Red Hat. Released 2026-10-22, updated 2026-10-23.

Affected:

- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4

No fix planned:

- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4

## Remediation

Fix deferred