Mako: Path traversal via double-slash URI prefix in TemplateLookup
Summary
TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations:
Template.__init__strips one leading/usingif/sliceTemplateLookup.get_template()strips all leading/usingre.sub(r"^\/+", "")
When a URI like //../../../../etc/passwd is passed:
get_template()strips all/→../../../../etc/passwd→ file found viaposixpath.join(dir_, u)Template.__init__strips one/→/../../../../etc/passwd→normpath→/etc/passwd/etc/passwd.startswith(..) →False→ check bypassed
Impact
Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template().
Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's BaseHTTPRequestHandler which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.
Fix
Changed Template.__init__ to use lstrip("/") instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | mako | < 1.3.11 | 1.3.11 |
References
- https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm
- https://nvd.nist.gov/vuln/detail/CVE-2026-41205
- https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
- https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2026-88.yaml
- https://github.com/sqlalchemy/mako
- https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- Python (PyPI)
- Package
mako- Disclosed
- 16.04.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-88 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-v92g-xgxw-vvmm - CC BY 4.0
Vulnerability history: mako
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 07.2010 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 2
Disclosures per year
- 2017: 0
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 3
earlier: 1
-
Mako: Path traversal via double-slash URI prefix in TemplateLookup this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.