What’s Vulnerable › Vulnerabilities

CVE-2020-12827

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-06-17 · updated 2026-06-17
• Weakness: CWE-22

Description

MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.

Affected products

• MJML: before 4.6.3 — fixed in 4.6.3

How to fix

Upgrade to a fixed version: MJML 4.6.3. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html
• http://seclists.org/fulldisclosure/2020/Jun/23
• https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12
• https://github.com/mjmlio/mjml/releases/tag/v4.6.3
• https://mjml.io/community
• https://rcesecurity.com
• https://twitter.com/mjmlio
• http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html
• http://seclists.org/fulldisclosure/2020/Jun/23
• https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12
• https://github.com/mjmlio/mjml/releases/tag/v4.6.3
• https://mjml.io/community

Get alerted when CVE-2020-12827 or the next vulnerability affects your stack