Skip to content
OpenAdvisories

Package · Maven

io.pebbletemplates:pebble

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.8
    CVE-2025-1686

    Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro

    Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates tha…

    dependency-track-bundled io.pebbletemplates:pebble Wolfi Maven
  • Critical 9.8
    CVE-2022-37767

    Pebble Templates protection mechanism bypass can lead to arbitrary code execution

    Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus e…

    io.pebbletemplates:pebble Maven