CVE-2025-1686
1 advisory.
Maven/io.pebbletemplates:pebble CVE-2025-1686: medium 6.8, EPSS 0.85%
Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.2.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-p75g-cxfj-7wrx
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-p75g-cxfj-7wrx
- https://nvd.nist.gov/vuln/detail/CVE-2025-1686
- https://github.com/PebbleTemplates/pebble/issues/680
- https://github.com/PebbleTemplates/pebble/issues/688
- https://github.com/PebbleTemplates/pebble/pull/715
- https://github.com/PebbleTemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329
- https://github.com/PebbleTemplates/pebble
- https://pebbletemplates.io/wiki/tag/include
- https://security.snyk.io/vuln/SNYK-JAVA-IOPEBBLETEMPLATES-8745594
CVE-2025-1686 · published · modified · JSON