CVE-2025-1686 Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro
A high-privileged attacker can read sensitive local files via malicious templates using the include tag in the Pebble template engine.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1686?
CVE-2025-1686 is a medium-severity path traversal vulnerability in io.pebbletemplates:pebble, published on 27 Feb 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build();
Weakness: CWE-73
Which versions are affected by CVE-2025-1686?
2 open source packages ship an affected version, including io.pebbletemplates:pebble. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.pebbletemplates:pebble Maven | All versions to 3.2.3 | None |
io.pebbletemplates:pebble Maven | All versions to 3.2.3 | None |
Products include Pebbletemplates Pebble Templates.
How do I fix CVE-2025-1686?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-1686 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1686 exists.
Other vulnerabilities in io.pebbletemplates:pebble
Sources
Also known as GHSA-p75g-cxfj-7wrx, ROOT-APP-MAVEN-CVE-2025-1686.