{"id":"CVE-2025-1686","details":"Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ.\r\r Workaround\r\rThis vulnerability can be mitigated by disabling the include macro in Pebble Templates:\r\rjava\rnew PebbleEngine.Builder()\r            .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder()\r                    .disallowedTokenParserTags(List.of(\"include\"))\r                    .build())\r            .build();","aliases":["GHSA-p75g-cxfj-7wrx"],"modified":"2026-08-12T15:13:19.565225Z","published":"2025-02-27T05:00:05.848Z","related":["CGA-vpj5-23ff-p6g4"],"database_specific":{"cwe_ids":["CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1686.json","cna_assigner":"snyk"},"references":[{"type":"WEB","url":"https://pebbletemplates.io/wiki/tag/include"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JAVA-IOPEBBLETEMPLATES-8745594"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1686.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1686"},{"type":"REPORT","url":"https://github.com/PebbleTemplates/pebble/issues/680"},{"type":"REPORT","url":"https://github.com/PebbleTemplates/pebble/issues/688"},{"type":"FIX","url":"https://github.com/PebbleTemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329"},{"type":"FIX","url":"https://github.com/PebbleTemplates/pebble/pull/715"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pebbletemplates/pebble","events":[{"introduced":"0"},{"fixed":"6b1060a82c316e5f9acf94a9430f77e69c4106ee"},{"fixed":"b3451c8f305a1a248fbcc2363fd307d0baaee329"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.1.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:pebbletemplates:pebble_templates:*:*:*:*:*:*:*:*"}}],"versions":["4.0.0","v4.0.0","3.2.4","v3.2.4","3.2.3","v3.2.3","3.2.2","v3.2.2","3.2.1","v3.2.1","3.2.0","v3.2.0","3.1.6","v3.1.6","3.1.5","v3.1.5","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.2","v3.0.1","v3.0.0","v3.0.0.BETA01","v2.2.3","v2.2.2","v2.2.1","v2.2.0","v2.0.0","v1.5.1","v1.6.0","v1.5.2","v1.5.0","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.1","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.4.0-beta","v0.3.0-beta","v0.2.0-beta","v0.1.5-beta","v0.1.4-beta","v0.1.3-beta","v0.1.2-beta","v0.1.1-beta","v0.1.0-beta","v0.0.3-alpha","v0.0.2-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1686.json","vanir_signatures_modified":"2026-08-12T15:13:19Z","vanir_signatures":[{"target":{"file":"pebble/src/test/java/io/pebbletemplates/pebble/TestRelativePath.java","function":"testPathWithBackslashesWithRelativePathWithForwardSlashes"},"deprecated":false,"digest":{"function_hash":"186967770007653408584596718400040196114","length":495},"id":"CVE-2025-1686-030e4afa","signature_type":"Function","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329"},{"signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"function":"testPathWithForwardSlashesWithRelativePathWithBackwardSlashes","file":"pebble/src/test/java/io/pebbletemplates/pebble/TestRelativePath.java"},"deprecated":false,"digest":{"function_hash":"313977321514697257712071890702089634291","length":496},"id":"CVE-2025-1686-2d07178b","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["12769955106462987363018181106753238977","136969055585200793459338994825228737669","35368226515399683076408866839188714871","171957446348316722251328222540769784051","37404495511844237112115740915711285370","265275824113834828780082684033109499225","240797733156352837173630071273962818657","327619008974803289756021580327001566455","310250053649447529587901138807418205829","123905247512365224153512047660851488053","79166850594051779312088087813040066836","160491737188664009298196844453071485756","96764273756848006202648194048751336818","287503205879385282133201875328263031341","86785624423780020910448849859103274603","37404495511844237112115740915711285370","130856292730682679882652776969843873801","112822821532754279369602976015699726162"],"threshold":0.9},"id":"CVE-2025-1686-486264df","signature_type":"Line","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/test/java/io/pebbletemplates/pebble/LoaderTest.java"}},{"source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java","function":"getReader"},"deprecated":false,"digest":{"function_hash":"112420595270943317669698227339579433372","length":450},"id":"CVE-2025-1686-80e8c933","signature_type":"Function","signature_version":"v1"},{"target":{"file":"pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java"},"deprecated":false,"digest":{"line_hashes":["172931234642853875153809040234252599465","200068349457264815094705004859079194224","47412341215209841646076216557414713224","120567553139527345221179033831549552033","87129993082154159313989589121345769749","302962616791995562728632874398668317423","19726028748390209297918290370490631462","56455323117734721778515180334491128897","150641004456174399841040346797490911425","64518956478377075981827892600119831168","109397329846058054103827631121603330604","222978525619083450236449054898888701331","225805371656841853500495318529452084126","20323731846743438572329503110251667673","122976437427754080991445497717273446335","236081314173518175048229312540872236388","38415696355268015195050368430480941184","122673796172396727280825060706550426158","85059363824347122342768661879595626284","166874630534768717270844557866879282132","170686763284411424528369312247390763127","186386723526566119563922006480682593082","58399253966687949000729295206477132834","53349607160300229831299947003776403468","134725398813225811228177575496617014926","172680699286456020384860923260695509774","119897965177221423918370739550083775199","192668458103568351576989653770183663769","195876219552457375484669715991477914417","193111581788982569251995302744429945885","322499551985745223007631957263973579237","323805323353127266881492019324045547399","110363129174176784457050532405110184817","52460793084400518159763434277069508732","209748810841679358417869973326657811117","29009640129401859063871845006152727673","118691063770655046622162110977144165383","145973166190744403541836420697846575211","81812141766135474402974448864785206748","81500252683909395321852104222601547956","55729100795293416667905719549234676644","204661539556080887197927508294943655779","62456357242554566150843372858501437120","268736474437136032824032692194061099442","283863386436642388109224682045553848808","124819089646628437198142277893887992046","222318115174919996850908351726866879282","158767977627914306059285052292352503408","274305230016938188938959413099381883848","260909622744698874297576276548352460079","256707017259692026863389885059821586318","232979457857414127572594599240898854902","17870624661480355401001784356680000473","252873957528615534727284631925284638807","69562296663601622997450877922822655633","87837107082809349457492703519755549387","140739627995062194150726878353371482423","111352504924209861378304556508544271352","48201260200779389019619677480036401606","221284299765938602665644386098359579146","229925651029670799349131617054093788393","334049176987057787974327393173276660179"],"threshold":0.9},"id":"CVE-2025-1686-98619c5f","signature_type":"Line","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329"},{"digest":{"function_hash":"46143573811512200436913811934480261545","length":522},"id":"CVE-2025-1686-b9c52dd1","signature_type":"Function","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/test/java/io/pebbletemplates/pebble/LoaderTest.java","function":"testFileLoader"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"40894268064511838168933625183376665443","length":753},"id":"CVE-2025-1686-c0cca91b","signature_type":"Function","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java","function":"getFile"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/test/java/io/pebbletemplates/pebble/TestRelativePath.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["107932505920353529387402492933059892535","296810859219811128384265987780976365666","139871227773783254337874631274398387364","255628967650390207426160933859675922781","143105646580100371142884508920594627951","265906724018451193454145618615118106653","274397186095287510302118347563278773909","254834577215207511555396497360652594966","40851581937393425664489457130240928396","79454724872688452810630871720146294159","143202255383873585197076902925617898245","281873937586835342790533428194362258441","223801807088286109375302159219365318869","134227705191989396551324015400641945195","106920678182704590160366332286554770992","268236765834981747134187709927382021786","82580732381210911327231706576802633021","122321501661838889239442694345408755027","301067203495462191739053514283621978685","99650757729474754768421947509665253669","132934946598832247424687623987623351300","195820391439154939651717776079723698877","285245242043142421009160711991930631935","335158901437933695064629761094531164100","106822906697335740615475731835963556775","236749065573676544289261091197993300544","221818253588517809604195942939062534933","97297317758889387256884640977127795779","132355358519407747418713288536980577425","44439056059910934448258764081342001831","139820904632342968067318295269720991287","259327059153688688028853573238032728913","252526010881978917619879892010417905611","5619418359083194231706969968631768450","185124491849758373751459633263066156448","288999931028826439487417060032968775365","335158901437933695064629761094531164100","322855765117095591821781327898319982050"]},"id":"CVE-2025-1686-c47fc73a"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/main/java/io/pebbletemplates/pebble/PebbleEngine.java"},"deprecated":false,"digest":{"line_hashes":["279317706125795688718991453869407846834","283332806496596529813093789511104615110","187908962499890348934987217222129772727","262450460102982016370226809444619544736","49684828478432766475405132417208876489","224754622337976730057745959160298413317","227869849744611919413265347392157460002","275400352535095664003666137097180667414","184912231200781601658237772217776791834","269580557671115596379803961470288758136","129010362672340885077900670355269459308","136057214012709660315462810992586641644","250343487665568807651663441255240127487","308604925187254475221892865557873184705","135669690123445207552480785653765408734","182634658741635275986184230428606808959","276449524915327582053513195568402877232","211062608361346078726990420608426658962","340011007992385344897480092217889585238","113869995279240105175759265296075925990","237590819637141668889181043846621808663","33020138110190397456497814190720243206","121039288653739636217128943030288492777","250567118743844788174345384106908052306","250334222019571225030038971025488870218","66562192973865943985372186433506400019","277238481678516506913732005712257894461","109596105384542329357527426867751810628","296854100194520569283835222692701907934","254271829827836794135014339577583679137","139069889694753187922266746696878368984","127855294127942254169612141152307198251","148283925890689420412979422543567426597","98975465826710818129439039995484472933","113481426202152668515590344331842267569","141002126996533287080773065286606415211","328823324402386297280887460721967487089","196972677277412106154167092295125533218","43619791007976971917865452889388258010","57372419381949075315223487794215114767","130865253940875538753088077027367893570"],"threshold":0.9},"id":"CVE-2025-1686-de30c1e4"},{"source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/main/java/io/pebbletemplates/pebble/utils/PathUtils.java"},"deprecated":false,"digest":{"line_hashes":["293150344831030607921205619501085131015","230474020439967937712257494402081856155","225015899498307990101793796463342894576","53010688594397485668287705842502245386"],"threshold":0.9},"id":"CVE-2025-1686-ee192dc8","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"124463053707445769846711704080408595237","length":1181},"id":"CVE-2025-1686-ef18d3e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329","target":{"file":"pebble/src/main/java/io/pebbletemplates/pebble/PebbleEngine.java","function":"build"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P"}]}