PT-2025-8914

CVE-2025-1686

·

Published

2025-02-27

·

Updated

2026-10-01

Description by

CVSS 3.1
6.8
Medium
MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions io.pebbletemplates:pebble versions (affected versions not specified)
Description The issue allows an attacker to control file names or paths via the include tag, potentially accessing sensitive local files like /etc/passwd or /proc/1/environ by crafting malicious notification templates.
Recommendations To mitigate this issue, disable the include macro in Pebble Templates by using the following Java code:
java
new PebbleEngine.Builder()
      .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder()
          .disallowedTokenParserTags(List.of("include"))
          .build())
      .build();
Exploitability
Exploit
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-73: External Control of File Name or Path
Related identifiers
CVE-2025-1686
GHSA-P75G-CXFJ-7WRX
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com