Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113731— djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Quick assessment

Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Djust 为 Django 提供了类似 Phoenix LiveView 的响应式服务端渲染功能，并借助 Rust 实现高性能。在 0.9.0 至 1.0.10、1.1.7、1.2.4 以及 1.3.0rc8 版本中，位于 的 MCP 工具会接受一个已存在的绝对模板路径（ ），并在读取该文件时未将解析后的路径限制在项目目录或已配置的模板目录内。本地 MCP 客户端可利用该工具作为文件存在性与可读性探测（oracle），并从 djust 进程有权读取的文件中获取匹配其 、 、 、 、 或 属性模式的子字符串。维护者

CVSS 3.3 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113731

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py accepts an existing absolute template_path and reads it without restricting the resolved path to the project or configured template directories. A local MCP client can use the tool as a file existence and readability oracle and can obtain substrings that match the tool's dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern from files readable by the djust process. The maintainer assessment states that the MCP server communicates over local stdio as the same operating-system user and has no network listener, and the tool does not return arbitrary raw file contents. This issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
djust-org djust >= 0.9.0, < 1.0.10 -

II. Public POCs for CVE-2026-113731

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113731

请登录查看更多情报信息。

Other References for CVE-2026-113731 (9)

IV. Related Vulnerabilities

Same product: djust
Same vendor: djust-org
Same weakness: CWE-22

V. Comments for CVE-2026-113731

No comments yet

Leave a comment