MJML CVE-2025-67898

Requires a deployment where the MJML compiler (library or CLI, versions through 4.18.0) processes MJML markup that an attacker can influence, and that markup must contain an mj-include directive pointing to a traversal path; the type="css" mode is the condition that enables actual file-content disclosure, whereas other include types only allow probing whether a target file exists. Exploitation is strongly limited by the local attack vector (AV:L) and high complexity (AC:H) inherited from the incomplete CVE-2020-12827 fix, and it is not exploitable where MJML only compiles trusted, developer-authored templates - the practical risk exists only for services that accept untrusted MJML input.

This is a genuinely low-priority issue despite being a path traversal flaw. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L) scores 4.5 (Medium), and the signals are internally consistent with a low real-world threat: the attack is local-vector (AV:L), requires high complexity (AC:H), and yields only limited confidentiality impact (C:L) - namely file-existence probing and, in the type="css" case, reading of file contents. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. A key caveat: although PR:N nominally means unauthenticated, the AV:L vector means exploitation is only possible where an application or pipeline compiles attacker-influenced MJML markup - the true privilege/exposure depends entirely on whether untrusted templates reach the compiler, which the raw vector does not capture. Also note this CVE exists because of an incomplete fix for CVE-2020-12827, indicating the original patch did not fully close the traversal, which is the most noteworthy risk signal here. Net: a real but low-severity, conditionally-exploitable information-disclosure bug, not an urgent priority.

An application that renders user-supplied MJML templates (for example an email-builder SaaS or a template-processing pipeline) passes attacker-controlled markup to MJML <= 4.18.0. The attacker inserts an mj-include tag with a traversal path (e.g. type="css" src="../../../../etc/passwd") to confirm file existence and read the contents of local files outside the intended template directory. No public proof-of-concept is identified at time of analysis; the attack requires that untrusted MJML input actually reaches the compiler.