GHSA-p75g-cxfj-7wrx: Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro
SummaryIf untrusted user input is used to dynamically create a `PebbleTemplate` with the method `PebbleEngine#getLiteralTemplate`, then an attacker can include arbitrary local files from the file system into the generated template, leaking potentially sensitive information into the output of `PebbleTemplate#evaluate`. This is done via the `include` macro.DetailsThe `include` macro calls `PebbleTempateImpl#resolveRelativePath` with the `relativePath` argument passed within the template:Example template:When `resolveRelativePath` is called, the `relativePath`  is resolved against the `PebbleTemplateImpl.name` variable.https://github.com/PebbleTemplates/pebble/blob/82ad7fcf9e9eaa45ee82ae3335a1409d19c10263/pebble/src/main/java/io/pebbletemplates/pebble/template/PebbleTemplateImpl.java#L380Unfortunately, when the template is created from a string, as is the case when `PebbleEngine#getLiteralTemplate` is used, the `PebbleTemplateImpl.name` variable is actually the entirety of the contents of the template, not a filename as the logic expects. The net result is that the `relativePath` is resolved against the system root directory. As a result, files accessible from the root directory of the filesystem can be included into a template.PoCThe following test demonstrates the vulnerability:As an attacker, the following malicious template demonstrates the vulnerability:ImpactThis is an arbitrary  Local File Inclusion (LFI) vulnerability. It can allow attackers to exfiltrate the contents of the local filesystem, including sensitive files into `PebbleTemplate` output. This can also be used to access the `/proc` filesystem which can give an attacker access to environment variables.FixThere exists no published fix for this vulnerability. The best way to mitigate this vulnerability is to disable the `include` macro in Pebble Templates.The following can safeguard your application from this vulnerability:Report TimelineVulnerability was reported under the Open Source Security Foundation (OpenSSF) [Model Outbound Vulnerability Disclosure Policy: Version 0.1](https://openssf.org/about/vulnerability-disclosure-policy/).[Jul 15, 2024](https://github.com/PebbleTemplates/pebble/issues/680#issue-2409727829) Maintainer Contacted to enable private vulnerability reporting[Jul 18, 2024](https://github.com/PebbleTemplates/pebble/issues/680#issuecomment-2236970984) I opened a GHSA 
to report this vulnerability to the maintainer https://github.com/PebbleTemplates/pebble/security/advisories/GHSA-7c6h-hmf9-7wj7 (private link)Jul 29, 2024 GHSA updated to ping maintainer about vulnerability, no responseOct 1, 2024 GHSA updated to ping maintainer about vulnerability, no responseNov 15, 2024 GHSA updated to inform maintainer that disclosure timeline had lapsed, no response.Feb 19, 2025 GHSA updated to inform maintainer that disclosure would occur imminently, no response.Feb 24, 2025 this GHSA was created to disclose this vulnerability **without a patch available**.For further discussion, see this issue: https://github.com/PebbleTemplates/pebble/issues/688CreditThis vulnerability was discovered by @JLLeitschuh while at [Chainguard Labs](https://www.chainguard.dev). Jonathan is currently independent.
CVSS v4.0: 7
CVSS v3.1: 6.8