CVE-2026-115353: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in lepture mistune

CVE-2026-115353 is a path traversal vulnerability in the Mistune markdown parser (lepture project) affecting all versions prior to 3.3.0. The vulnerability exists in the RST include directive, which improperly restricts pathname inputs. Attackers can craft markdown content with include directives referencing '../' sequences or absolute file paths to read arbitrary files on the host system. This can result in disclosure of sensitive information embedded in the rendered HTML output.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server running Mistune by supplying malicious markdown input. This can lead to exposure of sensitive data such as credentials or environment variables, potentially compromising the confidentiality of the system.

Upgrade Mistune to version 3.3.0 or later, where this path traversal vulnerability has been fixed. No other mitigation is indicated by the vendor advisory.