django-markupfield Arbitrary File Read

MEDIUM 5.0CVE-2015-0846 · GHSA-wxmr-7xjv-8xqw · PYSEC-2015-12 · Published 24/04/2015 · updated 17/06/2026

In short

CVE-2015-0846 is a MEDIUM (CVSS 5.0) vulnerability affecting django-markupfield, django-markupfield (django-markupfield project).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 79.0% of all vulnerabilities.
Fix: update to 1.3.2 or later.

Package	Affected versions	Patched versions
django-markupfield PyPI	`< 1.3.2`	`1.3.2`
django-markupfield django-markupfield_project	`≤ 1.3.1`	No fix yet

Description

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.

NVD description

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2015-0846 · ADVISORY
jamesturk/django-markupfield commit b45734e · WEB
jamesturk/django-markupfield · PACKAGE
jamesturk/django-markupfield · WEB
jamesturk/django-markupfield · WEB
pypa/advisory-database · WEB
djangoproject.com/weblog/2015/apr/21/docutils-security-advisory · WEB
debian.org/security/2015/dsa-3230 · WEB
GitHub Advisory GHSA-wxmr-7xjv-8xqw · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free