CVE-2026-44307
published 2026-05-12CVE-2026-44307: Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory…
PriorityP352high8.7CVSS 4.0
AVNACLATNPRNUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.61%
45.0th percentile
Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sqlalchemy | mako | < 1.3.12 | 1.3.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mako: Mako: Information disclosure via directory traversal
vendor_redhat·2026-05-12·CVSS 8.7
CVE-2026-44307 [HIGH] CWE-22 mako: Mako: Information disclosure via directory traversal
mako: Mako: Information disclosure via directory traversal
Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.
A flaw was found in Mako, a Python template library. A remote attacker could exploit a directory traversal vulnerability by crafting a Uniform Resource Identifier (URI) with backslash traversal. This bypasses security checks, allowing the attacker to read files outside the intended template directory, leading to information disclosure.
Package: exploit-intelligence
GHSA
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
ghsa·2026-05-06
CVE-2026-44307 [HIGH] CWE-22 Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
## Summary
On Windows, a URI using backslash traversal (e.g. `\..\..\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.
## Details
The root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\` as a path separator, while `posixpath` treats it as a literal character.
The vulnerability chain:
1. `get_template()` strips only leading `
No detection rules found.
No public exploits indexed.
2026-05-12
Published