Arbitrary file read vulnerability in MJML mj-include
The MJML framework is vulnerable to an absolute path traversal via the mj-include component, allowing an attacker to read arbitrary files from the hosting server's filesystem.
CVE search metadata
CVE search record: CVE-2025-67898. KEV: no. Brief: Arbitrary file read vulnerability in MJML mj-include. Brief link: https://feed.craftedsignal.io/briefs/2026-11-mjml-path-traversal-cve-2025-67898/
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 13, 09:12 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2025-67898 is an absolute path traversal vulnerability in the MJML framework's mj-include functionality. An attacker can supply a crafted MJML template to a server-side compiler, forcing the application to read arbitrary files from the filesystem.
Impact
Any service that compiles user-supplied MJML server-side may leak arbitrary readable files, including application source code, .env files, credentials, and sensitive host system files such as /etc/passwd.
Recommendation
Upgrade to mjml >= 5.0.0-alpha.9. If upgrading is not possible, pass ignoreIncludes: true to mjml2html and ensure untrusted input is not processed by the compiler.