{"id":"EUVD-2025-203312","enisaUuid":"697c5ebe-da54-3a77-b4d6-3c69f0fe95e5","description":"MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type\u003d\"css\" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.","datePublished":"Dec 14, 2025, 10:01:05 PM","dateUpdated":"Dec 15, 2025, 4:24:49 PM","baseScore":4.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L","references":"https://github.com/mjmlio/mjml/issues/3018\n","aliases":"CVE-2025-67898\nGHSA-45h5-66jx-r2wf\n","assigner":"mitre","epss":0.26,"enisaIdProduct":[{"id":"6af3fbfa-5425-3ca4-a238-449ddbf95755","product":{"name":"MJML","vendor":{"name":"MJML"}},"product_version":"0 ≤4.18.0"}],"enisaIdVendor":[{"id":"e7134ef1-0ddf-3300-905e-6f2094f96657","vendor":{"name":"MJML"}}],"enisaIdVulnerability":[{"id":"b7d7016a-818c-3fa8-afe1-fb886a57df7d","vulnerability":{"id":"GHSA-45h5-66jx-r2wf","description":"MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827","datePublished":"Dec 15, 2025, 12:30:25 AM","dateUpdated":"Jun 26, 2026, 8:28:42 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2020-12827\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-67898\nhttps://github.com/mjmlio/mjml/issues/3018\nhttps://github.com/mjmlio/mjml/pull/3033\nhttps://github.com/mjmlio/mjml/commit/517b376b068e71c713ec4bb4ef9e5b0b7235b8ce\nhttps://github.com/mjmlio/mjml\n","enisa_id":"EUVD-2025-203312\n","aliases":"GHSA-45h5-66jx-r2wf\nCVE-2025-67898\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d681b611-70a6-373e-9d11-31b6c10e5101","vulnerability":{"id":"CVE-2025-67898","description":"MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type\u003d\"css\" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.","datePublished":"Dec 14, 2025, 10:01:05 PM","dateUpdated":"Dec 15, 2025, 4:24:49 PM","status":"PUBLISHED","baseScore":4.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L","references":"https://github.com/mjmlio/mjml/issues/3018\n","enisa_id":"EUVD-2025-203312\n","assigner":"mitre","epss":0.26,"dataProcessed":"Oct 29, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"769f9331-b202-33a0-9d4e-db115edea6c0","product":{"name":"MJML","vendor":{"name":"MJML"}},"product_version":"0 ≤4.18.0"}],"vulnerabilityVendor":[{"id":"20a6e418-c66d-3fe9-9520-8c08725dee1b","vendor":{"name":"MJML"}}]}}],"enisaIdAdvisory":[]}