All versions of the package io.pebbletemplates:pebble are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build();

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Pebbletemplates
  • Pebble

Configuration 1 [-]

cpe:2.3:a:pebbletemplates:pebble:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/PebbleTemplates/pebble/issues/680 cve-icon cve-icon cve-icon
https://github.com/PebbleTemplates/pebble/issues/688 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-1686 cve-icon
https://pebbletemplates.io/wiki/tag/include cve-icon cve-icon cve-icon
https://security.snyk.io/vuln/SNYK-JAVA-IOPEBBLETEMPLATES-8745594 cve-icon cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-1686 cve-icon
History

Mon, 07 Apr 2025 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Pebbletemplates
Pebbletemplates pebble
CPEs cpe:2.3:a:pebbletemplates:pebble:*:*:*:*:*:*:*:*
Vendors & Products Pebbletemplates
Pebbletemplates pebble

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Feb 2025 13:45:00 +0000

Type Values Removed Values Added
Title io.pebbletemplates:pebble: Path Traversal Vulnerability in Pebble Templates
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 27 Feb 2025 05:15:00 +0000

Type Values Removed Values Added
Description All versions of the package io.pebbletemplates:pebble are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build();
Weaknesses CWE-73
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:P'}

cvssV4_0

{'score': 6.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2025-02-27T05:00:05.848Z

Updated: 2025-02-27T14:44:57.552Z

Reserved: 2025-02-25T10:32:01.608Z

Link: CVE-2025-1686

cve-icon Vulnrichment

Updated: 2025-02-27T14:44:39.962Z

cve-icon NVD

Status : Analyzed

Published: 2025-02-27T05:15:14.143

Modified: 2025-04-07T18:29:22.970

Link: CVE-2025-1686

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-02-27T05:00:05Z

Links: CVE-2025-1686 - Bugzilla