{"id":"GHSA-2mf3-mr2r-r4vf","aliases":[],"status":"published","title":"@rhinostone/swig: arbitrary local file read via include/extends path traversal","description":"### Overview\n\n`@rhinostone/swig` is a maintained fork of the abandoned `swig` template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The `{% include %}`, `{% extends %}`, and `{% import %}` tags resolve their target path through the filesystem loader without confining the result to the configured template root. A path that traverses upward (`../`) escapes the root and reads an arbitrary file from the host filesystem, whose contents are emitted into the rendered output.\n\n### Attack scenario\n\nThe dangerous case does **not** require the attacker to control template source — only template **data** (the `locals` passed at render time). An application that renders a trusted template whose include / extends path is variable-driven is exposed:\n\n```js\n// application code — a configured filesystem loader with a basepath\nswig.renderFile('page.html', { partial: req.query.partial });\n```\n\n```\n{# page.html — trusted template #}\n{% include partial %}\n```\n\nSetting `?partial=../../../../etc/passwd` makes the loader resolve and read that file, and its contents are rendered into the response. A literal in trusted source is equally affected: `{% include \"../../../etc/passwd\" %}`.\n\n### Impact\n\nArbitrary local file disclosure (confidentiality). An attacker able to influence an include / extends / import path — directly, or via untrusted `locals` — can read files outside the template directory: application configuration, credentials, source code, `/etc/passwd`, and so on. There is no integrity or availability impact.\n\n### Affected \u0026 patched\n\nEvery published version up to and including `2.7.0` is affected — `@rhinostone/swig`, and the shared `@rhinostone/swig-core` loader, hence `@rhinostone/swig-twig`, `@rhinostone/swig-jinja2`, and `@rhinostone/swig-django` as well.\n\nFixed in **`2.7.1`**: the filesystem loader now rejects any `include` / `extends` / `import` path that resolves outside the configured `basepath` root, including paths supplied through an untrusted runtime variable. A new `allowOutsideRoot` loader option is available for the rare case of intentionally reading files from outside the root.\n\n**Upgrade to `2.7.2` or later:** `2.7.1` fixed the vulnerability but introduced a regression — a *relative* `basepath` wrongly rejected every in-root template path. `2.7.2` resolves the `basepath` to an absolute path before the check and restores correct in-root resolution.\n\n### Workarounds\n\n- Upgrade to `2.7.2` (or later).\n- If you cannot upgrade immediately: configure the filesystem loader with an explicit `basepath`, and never pass untrusted data into an `{% include %}` / `{% extends %}` / `{% import %}` path.\n\n### References\n\n- GHSA-2rq5-699j-x7p6 — https://github.com/advisories/GHSA-2rq5-699j-x7p6\n- CVE-2023-25345 (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2023-25345\n- Upstream issue (swig-templates) — https://github.com/node-swig/swig-templates/issues/88\n- Fix commit — https://github.com/gina-io/swig/commit/381bdc305e0b10e45368d56324328b9b4f7017fc","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-18T16:31:16Z","modified":"2026-08-18T17:15:16Z","fixes":[{"ecosystem":"npm","package":"@rhinostone/swig","fixed_in":["2.7.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@rhinostone/swig-core","fixed_in":["2.7.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@rhinostone/swig-twig","fixed_in":["2.7.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@rhinostone/swig-jinja2","fixed_in":["2.7.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@rhinostone/swig-django","fixed_in":["2.7.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@rhinostone/swig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@rhinostone/swig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@rhinostone/swig-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@rhinostone/swig-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@rhinostone/swig-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@rhinostone/swig","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@rhinostone/swig-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@rhinostone/swig-twig","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@rhinostone/swig-jinja2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@rhinostone/swig-django","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.1"}]}]}],"references":[{"url":"https://github.com/gina-io/swig/security/advisories/GHSA-2mf3-mr2r-r4vf","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25345","tags":["advisory"]},{"url":"https://github.com/gina-io/swig/commit/381bdc305e0b10e45368d56324328b9b4f7017fc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2mf3-mr2r-r4vf"},{"url":"https://github.com/gina-io/swig","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2mf3-mr2r-r4vf","title":"@rhinostone/swig: arbitrary local file read via include/extends path traversal","description":"### Overview\n\n`@rhinostone/swig` is a maintained fork of the abandoned `swig` template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The `{% include %}`, `{% extends %}`, and `{% import %}` tags resolve their target path through the filesystem loader without confining the result to the configured template root. A path that traverses upward (`../`) escapes the root and reads an arbitrary file from the host filesystem, whose contents are emitted into the rendered output.\n\n### Attack scenario\n\nThe dangerous case does **not** require the attacker to control template source — only template **data** (the `locals` passed at render time). An application that renders a trusted template whose include / extends path is variable-driven is exposed:\n\n```js\n// application code — a configured filesystem loader with a basepath\nswig.renderFile('page.html', { partial: req.query.partial });\n```\n\n```\n{# page.html — trusted template #}\n{% include partial %}\n```\n\nSetting `?partial=../../../../etc/passwd` makes the loader resolve and read that file, and its contents are rendered into the response. A literal in trusted source is equally affected: `{% include \"../../../etc/passwd\" %}`.\n\n### Impact\n\nArbitrary local file disclosure (confidentiality). An attacker able to influence an include / extends / import path — directly, or via untrusted `locals` — can read files outside the template directory: application configuration, credentials, source code, `/etc/passwd`, and so on. There is no integrity or availability impact.\n\n### Affected \u0026 patched\n\nEvery published version up to and including `2.7.0` is affected — `@rhinostone/swig`, and the shared `@rhinostone/swig-core` loader, hence `@rhinostone/swig-twig`, `@rhinostone/swig-jinja2`, and `@rhinostone/swig-django` as well.\n\nFixed in **`2.7.1`**: the filesystem loader now rejects any `include` / `extends` / `import` path that resolves outside the configured `basepath` root, including paths supplied through an untrusted runtime variable. A new `allowOutsideRoot` loader option is available for the rare case of intentionally reading files from outside the root.\n\n**Upgrade to `2.7.2` or later:** `2.7.1` fixed the vulnerability but introduced a regression — a *relative* `basepath` wrongly rejected every in-root template path. `2.7.2` resolves the `basepath` to an absolute path before the check and restores correct in-root resolution.\n\n### Workarounds\n\n- Upgrade to `2.7.2` (or later).\n- If you cannot upgrade immediately: configure the filesystem loader with an explicit `basepath`, and never pass untrusted data into an `{% include %}` / `{% extends %}` / `{% import %}` path.\n\n### References\n\n- GHSA-2rq5-699j-x7p6 — https://github.com/advisories/GHSA-2rq5-699j-x7p6\n- CVE-2023-25345 (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2023-25345\n- Upstream issue (swig-templates) — https://github.com/node-swig/swig-templates/issues/88\n- Fix commit — https://github.com/gina-io/swig/commit/381bdc305e0b10e45368d56324328b9b4f7017fc","status":"published","published":"2026-08-18T16:31:16Z","modified":"2026-08-18T16:31:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"osv":[{"id":"GHSA-2mf3-mr2r-r4vf","title":"@rhinostone/swig: arbitrary local file read via include/extends path traversal","description":"### Overview\n\n`@rhinostone/swig` is a maintained fork of the abandoned `swig` template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The `{% include %}`, `{% extends %}`, and `{% import %}` tags resolve their target path through the filesystem loader without confining the result to the configured template root. A path that traverses upward (`../`) escapes the root and reads an arbitrary file from the host filesystem, whose contents are emitted into the rendered output.\n\n### Attack scenario\n\nThe dangerous case does **not** require the attacker to control template source — only template **data** (the `locals` passed at render time). An application that renders a trusted template whose include / extends path is variable-driven is exposed:\n\n```js\n// application code — a configured filesystem loader with a basepath\nswig.renderFile('page.html', { partial: req.query.partial });\n```\n\n```\n{# page.html — trusted template #}\n{% include partial %}\n```\n\nSetting `?partial=../../../../etc/passwd` makes the loader resolve and read that file, and its contents are rendered into the response. A literal in trusted source is equally affected: `{% include \"../../../etc/passwd\" %}`.\n\n### Impact\n\nArbitrary local file disclosure (confidentiality). An attacker able to influence an include / extends / import path — directly, or via untrusted `locals` — can read files outside the template directory: application configuration, credentials, source code, `/etc/passwd`, and so on. There is no integrity or availability impact.\n\n### Affected \u0026 patched\n\nEvery published version up to and including `2.7.0` is affected — `@rhinostone/swig`, and the shared `@rhinostone/swig-core` loader, hence `@rhinostone/swig-twig`, `@rhinostone/swig-jinja2`, and `@rhinostone/swig-django` as well.\n\nFixed in **`2.7.1`**: the filesystem loader now rejects any `include` / `extends` / `import` path that resolves outside the configured `basepath` root, including paths supplied through an untrusted runtime variable. A new `allowOutsideRoot` loader option is available for the rare case of intentionally reading files from outside the root.\n\n**Upgrade to `2.7.2` or later:** `2.7.1` fixed the vulnerability but introduced a regression — a *relative* `basepath` wrongly rejected every in-root template path. `2.7.2` resolves the `basepath` to an absolute path before the check and restores correct in-root resolution.\n\n### Workarounds\n\n- Upgrade to `2.7.2` (or later).\n- If you cannot upgrade immediately: configure the filesystem loader with an explicit `basepath`, and never pass untrusted data into an `{% include %}` / `{% extends %}` / `{% import %}` path.\n\n### References\n\n- GHSA-2rq5-699j-x7p6 — https://github.com/advisories/GHSA-2rq5-699j-x7p6\n- CVE-2023-25345 (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2023-25345\n- Upstream issue (swig-templates) — https://github.com/node-swig/swig-templates/issues/88\n- Fix commit — https://github.com/gina-io/swig/commit/381bdc305e0b10e45368d56324328b9b4f7017fc","status":"published","published":"2026-08-18T16:31:16Z","modified":"2026-08-18T17:15:16.4013065Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}