ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-113731

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Published Oct 21, 2026 · catalog updated Oct 21, 2026 · djust: Arbitrary absolute-path file

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-113731. EPSS is 0.19%. Act only if a listed version of djust: Arbitrary absolute-path file is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (djust: Arbitrary absolute-path file).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low3.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.19%
Remediation
Version ranges on file
Affected products
pip djust · pypi djust

### Affected version / file / line Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. ### Description When template_path is an absolute path to an existing file, it is used directly, with no confinement to the project/template directories — no realpath() + prefix check, no allowlist. open(resolved_path, ...) then reads the file. This is inconsistent with the sibling tool in the same file (loaddata, ~line 290-303), which explicitly rejects paths outside the project directory for its own path-like parameter: find_handlers_for_template has no equivalent check for template_path before the open() call. ### Impact An MCP client with access to this tool (available whenever the Django project is running the MCP server via python manage.py djust_mcp — no separate opt-in flag gates this specific tool beyond that) can read the contents of any file on disk that the process has read permission to and that exists, by passing an absolute path — e.g. /etc/passwd, application .env files, SSH keys, or any other sensitive file reachable by the server process's user. Mitigating factor (reduces this from High to Medium): the tool does not return the raw file content. It runs one fixed regex (dj-(?:click|submit|change|input|keydown|keyup)\s*=\s*['"]([^'"]+)['"]) against the content and returns only the matched handler-name strings, plus confirmation that the file exists and is readable (an existence/readability oracle on its own, independent of the regex match). If the targeted file happens to contain text matching that HTML-attribute-like pattern (plausible for config files, logs, or any text file with key="value"-shaped content), those substrings are returned in full — so the read is not purely blind, but it is not a general-purpose arbitrary-file-read primitive either. Proof of Concept / Reproduction Tra

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip djust>= 0.9.0, <= 1.0.9
  • pip djust>= 1.1.0, <= 1.1.6
  • pip djust>= 1.2.0.dev0, <= 1.2.3
  • pip djust>= 1.3.0.dev0, <= 1.3.0rc7
  • pypi djustversion unspecified

How to fix CVE-2026-113731

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-113731. EPSS is 0.19%. Act only if a listed version of djust: Arbitrary absolute-path file is installed.

Which versions are affected?

Compare what you have installed with >= 0.9.0, <= 1.0.9, >= 1.1.0, <= 1.1.6, >= 1.2.0.dev0, <= 1.2.3, >= 1.3.0.dev0, <= 1.3.0rc7. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal. EPSS 0.19%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · GitHub Advisory Database

    Detected

    ### Affected version / file / line Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. ### Description When template_path is an absolute path to an existing file, it is used directly, with no confinement to the projec

  2. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Affected version / file / line Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. ### Description When template_path is an absolute path to an existing file, it is used directly, with no confinement to the projec

Sources

  • CVE.orgVulnerability recordCVE-2026-113731

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-113731

    30-day exploitation probability 0.19%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-r57g-mc79-8hj2

    djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-113731

    @mcp.tool() def find_handlers_for_template(template_path: str) -> str: """ Args: template_path: Either a logical template name (e.g. 'demos/counter.html' — what you'd pass to render ) OR an absolute filesystem path. Both are searched. """ &hellip; resolved_path: str | None = None if os.path.isabs(template_path) and os.path.isfile(template_path): resolved_path = template_path else: &hellip; # logic

    advisories.gitlab.com

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • GitHub Advisory DatabaseOct 22, 2026
  • CVE.orgOct 22, 2026