CVE-2026-3312: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3312 is an information disclosure vulnerability in Pagure's reStructuredText (RST) rendering engine, allowing authenticated users to read arbitrary internal files from the server. The flaw stems from Pagure's failure to restrict the .. include:: directive provided by the docutils library during RST file rendering. The CVE was reported on 2026-02-27 and published on 2026-03-13, with a patch tracked via Red Hat Bugzilla. It is estimated to be of Medium severity (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The docutils library, used by Pagure to render RST files, supports a .. include:: directive that can reference local filesystem paths. Because Pagure does not sandbox or restrict this directive during the rendering pipeline, an authenticated user can craft an RST file containing .. include:: /etc/passwd (or any other server-side path) and have its contents rendered and returned in the browser. Exploitation requires only authentication — no elevated privileges are needed (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker to read arbitrary files accessible to the Pagure server process, including sensitive configuration files, credentials, SSH keys, or other internal data. This constitutes a confidentiality breach with no direct impact on integrity or availability. Depending on the files exposed (e.g., database credentials or API tokens), the vulnerability could serve as a stepping stone for further compromise or lateral movement within the hosting environment (Red Hat CVE, Red Hat Bugzilla).

The CVE status is currently "Reserved" and no public proof-of-concept exploit code has been identified. Exploitation requires authentication to the Pagure instance, which limits the attack surface compared to unauthenticated vulnerabilities. No in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV catalog listing has been reported at this time. A Nessus detection plugin (ID 302892) has been published by Tenable (Tenable Nessus, Red Hat CVE).

1. Authentication: Log in to a vulnerable Pagure instance with any valid user account.
2. Create or edit a repository file: Navigate to a repository and create or edit a file with an .rst extension.
3. Inject the include directive: Insert a malicious RST directive targeting a sensitive server-side file, for example:

   .. include:: /etc/passwd

   or for more sensitive targets:

   .. include:: /etc/shadow
   .. include:: /home/pagure/.ssh/id_rsa

4. Commit and render: Commit the file to the repository. Navigate to the file's rendered view in the Pagure web interface.
5. Exfiltrate data: The contents of the targeted server file are rendered inline in the browser, disclosing sensitive information to the attacker (Red Hat Bugzilla, Red Hat CVE).

• Logs: Web server or Pagure access logs showing authenticated requests to render .rst files, particularly those committed by unexpected users or containing unusual content; repeated rendering requests for the same RST file shortly after commit.
• File System: RST files in repositories containing .. include:: directives referencing absolute paths (e.g., /etc/, /home/, /var/) rather than relative repository paths.
• Application Logs: Docutils rendering errors or warnings in Pagure application logs related to file inclusion attempts for paths outside the repository directory.

A patch has been tracked in Red Hat Bugzilla (Bug 2443259) with dependent fixes in bugs 2448309 and 2448310. Administrators should apply the fixed version of Pagure once released. As a workaround, consider disabling RST rendering for untrusted users, restricting the docutils file_insertion_enabled setting to False in the Pagure docutils configuration, or limiting repository write access to trusted users only. Monitor for RST files containing .. include:: directives referencing absolute paths (Red Hat Bugzilla, Red Hat CVE).