CVE-2025-1686

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-1686
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1686.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-1686
Aliases
Related
Published
2025-02-27T05:00:05.848Z
Modified
2026-08-12T15:13:19.565225Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P CVSS Calculator
Summary
[none]
Details

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ.

Workaround

This vulnerability can be mitigated by disabling the include macro in Pebble Templates:

java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build();

Database specific 
{
    "cwe_ids": [
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1686.json",
    "cna_assigner": "snyk"
}
References

Affected packages

Git / github.com/pebbletemplates/pebble

Affected ranges

Type
GIT
Repo
https://github.com/pebbletemplates/pebble
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b1060a82c316e5f9acf94a9430f77e69c4106ee
Fixed
b3451c8f305a1a248fbcc2363fd307d0baaee329
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:pebbletemplates:pebble_templates:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.1.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.1.5
3.1.6
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
4.*
4.0.0
v0.*
v0.0.2-alpha
v0.0.3-alpha
v0.1.0-beta
v0.1.1-beta
v0.1.2-beta
v0.1.3-beta
v0.1.4-beta
v0.1.5-beta
v0.2.0-beta
v0.3.0-beta
v0.4.0-beta
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v2.*
v2.0.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v3.*
v3.0.0
v3.0.0.BETA01
v3.0.1
v3.0.10
v3.0.2
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v4.*
v4.0.0

Database specific

vanir_signatures_modified 
"2026-08-12T15:13:19Z"
vanir_signatures 
[
    {
        "id": "CVE-2025-1686-030e4afa",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 495.0,
            "function_hash": "186967770007653408584596718400040196114"
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "function": "testPathWithBackslashesWithRelativePathWithForwardSlashes",
            "file": "pebble/src/test/java/io/pebbletemplates/pebble/TestRelativePath.java"
        }
    },
    {
        "id": "CVE-2025-1686-2d07178b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 496.0,
            "function_hash": "313977321514697257712071890702089634291"
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "function": "testPathWithForwardSlashesWithRelativePathWithBackwardSlashes",
            "file": "pebble/src/test/java/io/pebbletemplates/pebble/TestRelativePath.java"
        }
    },
    {
        "id": "CVE-2025-1686-486264df",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "12769955106462987363018181106753238977",
                "136969055585200793459338994825228737669",
                "35368226515399683076408866839188714871",
                "171957446348316722251328222540769784051",
                "37404495511844237112115740915711285370",
                "265275824113834828780082684033109499225",
                "240797733156352837173630071273962818657",
                "327619008974803289756021580327001566455",
                "310250053649447529587901138807418205829",
                "123905247512365224153512047660851488053",
                "79166850594051779312088087813040066836",
                "160491737188664009298196844453071485756",
                "96764273756848006202648194048751336818",
                "287503205879385282133201875328263031341",
                "86785624423780020910448849859103274603",
                "37404495511844237112115740915711285370",
                "130856292730682679882652776969843873801",
                "112822821532754279369602976015699726162"
            ]
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "file": "pebble/src/test/java/io/pebbletemplates/pebble/LoaderTest.java"
        }
    },
    {
        "id": "CVE-2025-1686-80e8c933",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 450.0,
            "function_hash": "112420595270943317669698227339579433372"
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "function": "getReader",
            "file": "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java"
        }
    },
    {
        "id": "CVE-2025-1686-98619c5f",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "172931234642853875153809040234252599465",
                "200068349457264815094705004859079194224",
                "47412341215209841646076216557414713224",
                "120567553139527345221179033831549552033",
                "87129993082154159313989589121345769749",
                "302962616791995562728632874398668317423",
                "19726028748390209297918290370490631462",
                "56455323117734721778515180334491128897",
                "150641004456174399841040346797490911425",
                "64518956478377075981827892600119831168",
                "109397329846058054103827631121603330604",
                "222978525619083450236449054898888701331",
                "225805371656841853500495318529452084126",
                "20323731846743438572329503110251667673",
                "122976437427754080991445497717273446335",
                "236081314173518175048229312540872236388",
                "38415696355268015195050368430480941184",
                "122673796172396727280825060706550426158",
                "85059363824347122342768661879595626284",
                "166874630534768717270844557866879282132",
                "170686763284411424528369312247390763127",
                "186386723526566119563922006480682593082",
                "58399253966687949000729295206477132834",
                "53349607160300229831299947003776403468",
                "134725398813225811228177575496617014926",
                "172680699286456020384860923260695509774",
                "119897965177221423918370739550083775199",
                "192668458103568351576989653770183663769",
                "195876219552457375484669715991477914417",
                "193111581788982569251995302744429945885",
                "322499551985745223007631957263973579237",
                "323805323353127266881492019324045547399",
                "110363129174176784457050532405110184817",
                "52460793084400518159763434277069508732",
                "209748810841679358417869973326657811117",
                "29009640129401859063871845006152727673",
                "118691063770655046622162110977144165383",
                "145973166190744403541836420697846575211",
                "81812141766135474402974448864785206748",
                "81500252683909395321852104222601547956",
                "55729100795293416667905719549234676644",
                "204661539556080887197927508294943655779",
                "62456357242554566150843372858501437120",
                "268736474437136032824032692194061099442",
                "283863386436642388109224682045553848808",
                "124819089646628437198142277893887992046",
                "222318115174919996850908351726866879282",
                "158767977627914306059285052292352503408",
                "274305230016938188938959413099381883848",
                "260909622744698874297576276548352460079",
                "256707017259692026863389885059821586318",
                "232979457857414127572594599240898854902",
                "17870624661480355401001784356680000473",
                "252873957528615534727284631925284638807",
                "69562296663601622997450877922822655633",
                "87837107082809349457492703519755549387",
                "140739627995062194150726878353371482423",
                "111352504924209861378304556508544271352",
                "48201260200779389019619677480036401606",
                "221284299765938602665644386098359579146",
                "229925651029670799349131617054093788393",
                "334049176987057787974327393173276660179"
            ]
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "file": "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java"
        }
    },
    {
        "id": "CVE-2025-1686-b9c52dd1",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 522.0,
            "function_hash": "46143573811512200436913811934480261545"
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "function": "testFileLoader",
            "file": "pebble/src/test/java/io/pebbletemplates/pebble/LoaderTest.java"
        }
    },
    {
        "id": "CVE-2025-1686-c0cca91b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 753.0,
            "function_hash": "40894268064511838168933625183376665443"
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "function": "getFile",
            "file": "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java"
        }
    },
    {
        "id": "CVE-2025-1686-c47fc73a",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "107932505920353529387402492933059892535",
                "296810859219811128384265987780976365666",
                "139871227773783254337874631274398387364",
                "255628967650390207426160933859675922781",
                "143105646580100371142884508920594627951",
                "265906724018451193454145618615118106653",
                "274397186095287510302118347563278773909",
                "254834577215207511555396497360652594966",
                "40851581937393425664489457130240928396",
                "79454724872688452810630871720146294159",
                "143202255383873585197076902925617898245",
                "281873937586835342790533428194362258441",
                "223801807088286109375302159219365318869",
                "134227705191989396551324015400641945195",
                "106920678182704590160366332286554770992",
                "268236765834981747134187709927382021786",
                "82580732381210911327231706576802633021",
                "122321501661838889239442694345408755027",
                "301067203495462191739053514283621978685",
                "99650757729474754768421947509665253669",
                "132934946598832247424687623987623351300",
                "195820391439154939651717776079723698877",
                "285245242043142421009160711991930631935",
                "335158901437933695064629761094531164100",
                "106822906697335740615475731835963556775",
                "236749065573676544289261091197993300544",
                "221818253588517809604195942939062534933",
                "97297317758889387256884640977127795779",
                "132355358519407747418713288536980577425",
                "44439056059910934448258764081342001831",
                "139820904632342968067318295269720991287",
                "259327059153688688028853573238032728913",
                "252526010881978917619879892010417905611",
                "5619418359083194231706969968631768450",
                "185124491849758373751459633263066156448",
                "288999931028826439487417060032968775365",
                "335158901437933695064629761094531164100",
                "322855765117095591821781327898319982050"
            ]
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "file": "pebble/src/test/java/io/pebbletemplates/pebble/TestRelativePath.java"
        }
    },
    {
        "id": "CVE-2025-1686-de30c1e4",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "279317706125795688718991453869407846834",
                "283332806496596529813093789511104615110",
                "187908962499890348934987217222129772727",
                "262450460102982016370226809444619544736",
                "49684828478432766475405132417208876489",
                "224754622337976730057745959160298413317",
                "227869849744611919413265347392157460002",
                "275400352535095664003666137097180667414",
                "184912231200781601658237772217776791834",
                "269580557671115596379803961470288758136",
                "129010362672340885077900670355269459308",
                "136057214012709660315462810992586641644",
                "250343487665568807651663441255240127487",
                "308604925187254475221892865557873184705",
                "135669690123445207552480785653765408734",
                "182634658741635275986184230428606808959",
                "276449524915327582053513195568402877232",
                "211062608361346078726990420608426658962",
                "340011007992385344897480092217889585238",
                "113869995279240105175759265296075925990",
                "237590819637141668889181043846621808663",
                "33020138110190397456497814190720243206",
                "121039288653739636217128943030288492777",
                "250567118743844788174345384106908052306",
                "250334222019571225030038971025488870218",
                "66562192973865943985372186433506400019",
                "277238481678516506913732005712257894461",
                "109596105384542329357527426867751810628",
                "296854100194520569283835222692701907934",
                "254271829827836794135014339577583679137",
                "139069889694753187922266746696878368984",
                "127855294127942254169612141152307198251",
                "148283925890689420412979422543567426597",
                "98975465826710818129439039995484472933",
                "113481426202152668515590344331842267569",
                "141002126996533287080773065286606415211",
                "328823324402386297280887460721967487089",
                "196972677277412106154167092295125533218",
                "43619791007976971917865452889388258010",
                "57372419381949075315223487794215114767",
                "130865253940875538753088077027367893570"
            ]
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "file": "pebble/src/main/java/io/pebbletemplates/pebble/PebbleEngine.java"
        }
    },
    {
        "id": "CVE-2025-1686-ee192dc8",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293150344831030607921205619501085131015",
                "230474020439967937712257494402081856155",
                "225015899498307990101793796463342894576",
                "53010688594397485668287705842502245386"
            ]
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "file": "pebble/src/main/java/io/pebbletemplates/pebble/utils/PathUtils.java"
        }
    },
    {
        "id": "CVE-2025-1686-ef18d3e4",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1181.0,
            "function_hash": "124463053707445769846711704080408595237"
        },
        "source": "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329",
        "target": {
            "function": "build",
            "file": "pebble/src/main/java/io/pebbletemplates/pebble/PebbleEngine.java"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1686.json"