The flaw is a path traversal vulnerability located in the RST include directive of Mistune, a markdown parsing library. It allows an attacker to specify relative or absolute paths containing directory traversal sequences (e.g., '../') in the markdown input. When the library processes the include directive, it resolves the path without proper validation and reads the target file, embedding its contents into the rendered HTML. This capability can expose sensitive files such as credentials, configuration data, or environment variables, violating confidentiality. The weakness is documented as CWE-22.

All versions of Mistune released before 3.3.0 are affected, regardless of the installation environment. The product is distributed by Lepture and is commonly used in Python applications that render user-supplied markdown. Any system that incorporates those pre‑3.3.0 releases for processing markdown is at risk.

The CVSS score of 9.2 indicates a critical severity, and the vulnerability is highly exploitable when an attacker can inject markdown input processed by Mistune. The EPSS score is not available, but the fact that the flaw permits reading arbitrary files without authentication or other prerequisites makes exploitation straightforward once input is accepted. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote, depending on whether the markdown source is user controlled; no specific network exposure is required, so defense in depth and input validation are critical.