PT-2025-51175 · Mjml · Mjml

Published 2025-12-14 · Updated 2025-12-15 · CVE-2025-67898

Positive Technologies · (AI Summary)

CVSS v3.1

4.5

4.5

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions MJML versions through 4.18.0

Description The software contains a directory traversal flaw within the

mj-include

functionality. This allows an attacker to check for the existence of files and, in cases where the type is set to "css", read files. This issue stems from an incomplete resolution of a previously identified problem.

Recommendations Update to a version beyond 4.18.0.

Fix

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2025-67898

Affected Products

Mjml

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-67898 · Security Note
• https://github.com/mjmlio/mjml/issues/3018 · Note
• https://twitter.com/VulmonFeeds/status/2000330963457376704 · Twitter Post
• https://t.me/CVEtracker/39783 · Telegram Post
• https://t.me/cveNotify/145721 · Telegram Post
• https://twitter.com/CVEnew/status/2000611259293868115 · Twitter Post