django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0846
Reference (s):
- https://github.com/jamesturk/django-markupfield/blob/master/CHANGELOG
- DEBIAN:DSA-3230
- URL: http://www.debian.org/security/2015/dsa-3230