ROOT-APP-MAVEN-CVE-2025-1686 CVE-2025-1686 in io.pebbletemplates:pebble - Patched by Root

Root has patched CVE-2025-1686 in the io.pebbletemplates:pebble package for Root:Maven. Multiple fixed versions available...

ai.djl.timeseries:timeseries (>=0.19.0, <=0.33.0), cc.akkaha:pea-dubbo_2.12 (>=0.1.5, <=0.7.0) +492 more potentially affected by CVE-2025-1686 via io.pebbletemplates:pebble (>=3.0.0.beta01, <=3.2.3)

io.pebbletemplates:pebble MAVEN version =3.0.0.beta01, =0.19.0, =0.1.5, =0.3.0, =0.1.0, =4.1.0, =16.5.0, =6.5.1, =6.0.0-rc17, =12.0.0-beta, =16.0.9 and more Source cves: CVE-2025-1686 Source advisory: GHSA-P75G-CXFJ-7WRX...

io.pebbletemplates:pebble-spring-boot-2-starter (2.6.2), io.pebbletemplates:pebble-spring-boot-starter (2.6.2) +3 more potentially affected by CVE-2025-1686 +1 more via io.pebbletemplates:pebble (2.6.2)

io.pebbletemplates:pebble MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.pebbletemplates:pebble and may be impacted: - io.pebbletemplates:pebble-spring-boot-2-starter 2.6.2 - io.pebbletemplates:pebble-spring-boot-starter 2.6.2 -...

ai.djl.timeseries:timeseries (>=0.19.0, <=0.33.0), cc.akkaha:pea-dubbo_2.12 (>=0.1.5, <=0.7.0) +492 more potentially affected by CVE-2025-1686 +1 more via io.pebbletemplates:pebble (>=3.0.0.beta01, <=3.2.3)

io.pebbletemplates:pebble MAVEN version =3.0.0.beta01, =0.19.0, =0.1.5, =0.3.0, =0.1.0, =4.1.0, =16.5.0, =6.5.1, =6.0.0-rc17, =12.0.0-beta, =16.0.9 and more Source cves: CVE-2025-1686, CVE-2025-27137 Source advisory: OSV:GHSA-P75G-CXFJ-7WRX...

ai.djl.timeseries:timeseries (>=0.19.0, <=0.38.0), ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4) +604 more potentially affected by CVE-2025-1686 via io.pebbletemplates:pebble (>=2.5.0, <=4.0.0)

io.pebbletemplates:pebble MAVEN version =2.5.0, =0.19.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.0.3, =0.0.2, =0.0.2, =0.0.2, =0.8.4 - ai.mindconnect:mc-agent-runtime-feature-core 0.8.4 - ai.mindconnect:mc-agent-runtime-feature-file-upload 0.8.4 - ai.mindconnect:mc-agent-runtime-feature-skills...

CVE-2025-1686

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...

CVE-2025-1686: External Control of File Name or Path

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...

ai.djl.timeseries:timeseries (>=0.19.0, <=0.32.0), cc.akkaha:pea-dubbo_2.12 (>=0.1.5, <=0.7.0) +291 more potentially affected by CVE-2022-37767 via io.pebbletemplates:pebble (>=3.0.0.beta01, <=3.1.5)

io.pebbletemplates:pebble MAVEN version =3.0.0.beta01, =0.19.0, =0.1.5, =0.3.0, =0.1.0, =4.1.0, =6.5.1, =6.0.0-rc17, =12.0.0-beta, =12.0.0-beta, =16.0.9 and more Source cves: CVE-2022-37767 Source advisory: GHSA-WXX5-W9JC-48WX...