CVE-2025-1686

6.8 MEDIUM

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the...

Published: 2025-02-27 · Last updated: 2026-06-05

Severity and scoring

CVSS: 6.8 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CWE: CWE-73

Affected products

Vendor	Product
pebbletemplates	pebble_templates

Description

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build();

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2025-1686
[Patch]https://github.com/PebbleTemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329
[Other]https://github.com/PebbleTemplates/pebble/issues/680
[Vendor advisory]https://github.com/PebbleTemplates/pebble/issues/688
[Other]https://pebbletemplates.io/wiki/tag/include
[Exploit reference]https://security.snyk.io/vuln/SNYK-JAVA-IOPEBBLETEMPLATES-8745594
[Patch]https://github.com/PebbleTemplates/pebble/pull/715
[Exploit reference]https://security.snyk.io/vuln/SNYK-JAVA-IOPEBBLETEMPLATES-8745594

Related CVEs

Same CWE

CVE-2026-10303 — In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 be... (7.4 HIGH)
CVE-2026-39006 — An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component (9.8 CRITICAL)
CVE-2026-34030 — The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch i...
CVE-2026-11527 — Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument... (8.6 HIGH)
CVE-2026-11526 — GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle (9.8 CRITICAL)