CVE-2026-113731 — djust: arbitrary absolute-path file read in the find_handlers_for_template MCP tool

The djust MCP tool find_handlers_for_template does not confine an absolute template_path to the project or template directories. An MCP client with access to the tool can read existing files readable by the process; the response returns handler names matching a fixed pattern and confirms that the file exists and is readable. The source identifies this as CWE-22, improper limitation of a pathname to a restricted directory. The maintainer rates the impact Low (CVSS 3.1: 3.3), while the audit description classifies it as Medium.