The vulnerability in Pebble Templates arises from the ability of the include tag to resolve external file paths without properly sanitizing the input. An attacker who can supply or influence templated content can craft a malicious notification template that references arbitrary file paths such as /etc/passwd or /proc/1/environ. The result is that privileged application users gain read access to sensitive local files, exposing configuration data, credentials, or environment variables, potentially facilitating further compromise. This defect is classified as CWE‑73, External Control of File Name or Path.

Affected systems are applications that incorporate the Pebble library (io.pebbletemplates:pebble) in versions 0 and up to, but not including, 4.1.0. The vulnerable code resides in the include tag functionality of the Pebble Engine. Any deployment that utilizes the default engine or an unmodified custom engine may expose the flaw.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of < 1% suggests a low probability of exploitation at the time of analysis, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is application‑level: an adversary must be able to supply or modify template content that the application renders. High‑privileged application execution is required to read sensitive local files, but once an attacker can inject a malicious template, the included file contents are returned in the rendered output, enabling data exfiltration.