CVE-2025-67898: MJML Path Traversal Vulnerability

CVE-2025-67898 Overview

CVE-2025-67898 is a directory traversal vulnerability in MJML, an open-source markup language used to generate responsive HTML emails. Versions through 4.18.0 permit the mj-include directive to traverse outside intended directories. Attackers can test for the existence of arbitrary files on the host system. When the include type is set to css, attackers can read file contents into the rendered output. The flaw exists because the fix for CVE-2020-12827 was incomplete, leaving the traversal path reachable. The weakness is classified under [CWE-36: Absolute Path Traversal].

Critical Impact
Local attackers who can supply MJML templates can enumerate filesystem paths and read arbitrary files readable by the MJML process when CSS includes are used.

Affected Products

MJML versions through 4.18.0
Applications embedding the mjml npm package for server-side email rendering
Build pipelines that compile untrusted MJML template input

Discovery Timeline

2025-12-14 - CVE-2025-67898 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67898

Vulnerability Analysis

MJML compiles template markup into HTML. The mj-include component pulls external content into a template at compile time. The compiler resolves the path attribute relative to the including file, but does not restrict traversal sequences such as ../ that escape the template root.

Two distinct behaviors expose information. First, the compiler reports differentiated errors when a referenced path does not exist versus when it does. This difference lets an attacker probe arbitrary filesystem locations and infer which files are present.

Second, when the include is declared with type="css", MJML reads the target file and embeds its contents in the compiled output. An attacker who controls template input can therefore exfiltrate readable files such as configuration files, keys stored in predictable locations, or application source.

The issue is a regression against CVE-2020-12827. The previous remediation did not fully canonicalize the resolved path, allowing crafted relative paths to reach outside the sanctioned include directory.

Root Cause

The root cause is incomplete path normalization in the mj-include resolver. MJML did not reject resolved paths that fall outside the parent template directory after traversal segments were applied. Trusting the resolved path for file reads enabled both existence probing and content disclosure.

Attack Vector

Exploitation requires local access to supply MJML template content to a compilation process. The attacker crafts an mj-include element whose path attribute contains traversal sequences pointing at target files. For disclosure, the attacker sets type="css" so the compiler reads and embeds the file contents in the rendered HTML. Exploit complexity is elevated because the attacker must know likely file locations and have a channel to retrieve the compiled output.

// Example exploitation code (sanitized)
No verified proof-of-concept code is published. See the
[GitHub issue discussion](https://github.com/mjmlio/mjml/issues/3018)
for technical details and reproduction notes.

Detection Methods for CVE-2025-67898

Indicators of Compromise

MJML templates containing mj-include elements with ../ or absolute paths outside the designated template directory
MJML templates using type="css" on mj-include elements that reference non-CSS filesystem paths
Compiled HTML output containing fragments of system files such as /etc/passwd, .env, or private key material

Detection Strategies

Statically scan MJML source files in repositories and build artifacts for mj-include directives referencing paths that escape the project root
Inspect MJML compiler logs for repeated file-not-found errors on paths outside the template directory, which suggest existence probing
Add a pre-compilation linter to the CI pipeline that rejects templates with traversal sequences or absolute path attributes

Monitoring Recommendations

Monitor file access by the MJML process using host telemetry and alert on reads outside the template directory
Audit source control for commits that introduce mj-include with user-controlled path values
Track MJML package versions across build hosts and flag any instance at or below 4.18.0

How to Mitigate CVE-2025-67898

Immediate Actions Required

Upgrade MJML to a version above 4.18.0 that contains the corrected path resolution logic once published by the maintainers
Treat all MJML template input from untrusted sources as hostile and reject templates that contain mj-include directives
Run MJML compilation under a least-privilege account that cannot read sensitive configuration, credentials, or key material

Patch Information

Track the upstream remediation through the MJML GitHub issue discussion. Apply the maintainer-released fix once available and rebuild any images or bundles that embed the mjml package. Rotate secrets that may have been readable by the MJML process if template input originated from untrusted users.

Workarounds

Disable mj-include processing in wrappers that accept external template input, or strip the element before passing content to the compiler
Chroot or containerize the MJML compiler so only the sanctioned template directory is visible on the filesystem
Enforce an allowlist of permitted include paths and reject any resolved path that falls outside the template root

bash

# Configuration example
# Pre-compile sanitization: reject templates with mj-include traversal
grep -RInE '<mj-include[^>]+path="([^"]*\.\.|/)' ./templates && \
  echo "Blocked: mj-include references outside template root" && exit 1