Description
MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
Remediation
References
http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html
http://seclists.org/fulldisclosure/2020/Jun/23
https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12
https://github.com/mjmlio/mjml/releases/tag/v4.6.3
https://mjml.io/community
https://rcesecurity.com
https://twitter.com/mjmlio
Related Vulnerabilities
CVE-2023-33246 Vulnerability in maven package org.apache.rocketmq:rocketmq-controller
CVE-2020-6858 Vulnerability in maven package com.hotels.styx:styx-components
CVE-2022-1243 Vulnerability in maven package org.webjars.bower:urijs
CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.enigma2
CVE-2022-1291 Vulnerability in npm package tableexport.jquery.plugin