CVE-2026-41205
published 2026-04-23CVE-2026-41205: Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g.…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.53%
44.0th percentile
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mta | mta-solution-server-rhel9 | — | — |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| rhoai | odh-training-cuda128-torch29-py312-rhel9 | — | — |
| satellite | iop-host-inventory-rhel9 | — | — |
| sqlalchemy | mako | < 1.3.11 | 1.3.11 |
| sqlalchemy | mako | >= 0 < 1.4.2 | 1.4.2 |
| ubuntu | mako | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.5HIGH
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
ghsa·2026-10-05·CVSS 7.5
CVE-2026-102991 [HIGH] CWE-22 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
## Summary
On Windows, a `TemplateLookup` URI beginning with a drive designator (e.g. `C:/../../secret.txt` or `C:\..\..\secret.txt`) bypasses the directory traversal check in `Template.__init__`, allowing reads of files outside the configured template directory.
This is a third, independent instance of the root cause behind CVE-2026-41205 (the `//` prefix) and CVE-2026-44307 (the backslash form). Both of those fixes normalized a separator *spelling*. Neither addressed the other way `posixpath` and `ntpath` disagree: the drive designator. Both prior fixes remain effective on their own terms; this variant survives them for an independent reason.
## Details
The root cause is the same `posixpath` / `os.path` mismatch:
VulDB
sqlalchemy mako up to 1.3.10 TemplateLookup.get_template path traversal (GHSA-v92g-xgxw-vvmm)
vuldb·2026-04-23·CVSS 7.7
CVE-2026-41205 [HIGH] sqlalchemy mako up to 1.3.10 TemplateLookup.get_template path traversal (GHSA-v92g-xgxw-vvmm)
A vulnerability labeled as critical has been found in sqlalchemy mako up to 1.3.10. Affected by this vulnerability is the function TemplateLookup.get_template. Executing a manipulation can lead to path traversal.
The identification of this vulnerability is CVE-2026-41205. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
Ubuntu
Mako vulnerability
vendor_ubuntu·2026-05-05
CVE-2026-41205 Mako vulnerability
Title: Mako vulnerability
Summary: Mako could be made to expose sensitive information over the network.
It was discovered that Mako incorrectly handled URIs with double-slash
prefixes in TemplateLookup. A remote attacker could possibly use this issue
to obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
mako: python: Mako: Information disclosure via path traversal vulnerability
vendor_redhat·2026-04-23·CVSS 7.7
CVE-2026-41205 [HIGH] CWE-22 mako: python: Mako: Information disclosure via path traversal vulnerability
mako: python: Mako: Information disclosure via path traversal vulnerability
A flaw was found in Mako, a Python template library. This vulnerability, known as path traversal, allows an attacker to access files outside of the intended directory. By providing a specially crafted input to the TemplateLookup.get_template() function, a remote attacker can exploit an inconsistency in how the system handles URIs starting with //. This could lead to the disclosure of sensitive information from any file readable by the affected application.
Mitigation: To mitigate this issue, applications utilizing the Mako template library must validate and sanitize all input before passing it to the `TemplateLookup.get_template()` function. Implementing robust input validation routines within applications will p
No detection rules found.
No public exploits indexed.
2026-04-23
Published