Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the include key in the _config.yml file.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jekyll | Jekyllrb | 3.8.0 | 3.8.3 |
| Jekyll | Jekyllrb | 3.7.0 | 3.7.3 |
| Jekyll | Jekyllrb | * | 3.6.2 |