The Mistune Markdown parser allows an attacker to supply an Include directive containing a crafted file path that escapes the intended markdown directory. The parser expands and normalizes the path without checking that the resolved file remains within the base directory, enabling arbitrary file reads when a Markdown file is processed with md.read(). This path‑traversal flaw (CWE‑22) permits reading of any file that the process can reach, compromising confidentiality.

Mistune, maintained by lepture, is impacted in all releases before 3.3.0. The fix is in version 3.3.0, so systems running earlier Mistune versions that employ the Include plugin or call Parse while processing untrusted Markdown files are at risk.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an attacker to supply a malicious Markdown file or otherwise influence an application that processes untrusted input with the Include plugin; if successful, the attacker can read any file accessible to the application process, potentially exposing sensitive configuration data or secrets. This risk is significant for services that accept Markdown from untrusted sources.