Skip to main content

Mako CVE-2026-41205

| EUVDEUVD-2026-25279 HIGH
Path Traversal (CWE-22)
2026-04-23 security-advisories@github.com GHSA-v92g-xgxw-vvmm
Python Path Traversal Mako Sqlalchemy
7.7
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Unauthenticated file read (C:H, I/A:N), but AC:H because exploitation requires an app that forwards raw input to get_template() and an HTTP path that isn't normalized.

3.1 AV:N/AC:H/PR:N/UI:N/S:N/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat
5.9 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 04:31 vuln.today
Analysis Generated
Jul 24, 2026 - 04:31 vuln.today
Patch released
Apr 28, 2026 - 19:14 nvd
Patch available
Patch available
Apr 23, 2026 - 21:01 EUVD
EUVD ID Assigned
Apr 23, 2026 - 19:27 euvd
EUVD-2026-25279
CVE Published
Apr 23, 2026 - 19:17 nvd
HIGH 7.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 7 pypi packages depend on mako (6 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.3.11.

DescriptionGitHub Advisory

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

AnalysisAI

Arbitrary file read in Mako (the Python template library maintained under the SQLAlchemy project) affects all versions prior to 1.3.11, where TemplateLookup.get_template() mishandles URIs beginning with a double slash (e.g. //../../../etc/passwd). Because get_template() strips all leading slashes while Template.__init__ stripped only one, the 'relative outside of root' safety check is bypassed, letting any file readable by the process be returned as rendered template content when an application feeds untrusted input into get_template(). CVSS 4.0 rates it 7.7 (confidentiality-only); it is not in CISA KEV and EPSS is very low (0.05%), but the CVSS exploit-maturity flag E:P and the vendor's published test cases indicate proof-of-concept exploit code exists.

Technical ContextAI

Mako is a widely used Python server-side templating engine (CPE cpe:2.3:a:sqlalchemy:mako). The flaw is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory (path traversal) caused by an inconsistency between two leading-slash normalizers on the same URI. TemplateLookup.get_template() strips every leading slash via re.sub(r'^\/+', ''), turning '//../../../../etc/passwd' into '../../../../etc/passwd', which resolves against the template directory with posixpath.join and locates the target file. Template.__init__ then stripped only one slash, producing '/../../../../etc/passwd', which normpath collapses to an absolute '/etc/passwd'; the guard u_norm.startswith('..') returns False, so the directory-escape check is silently skipped. The upstream fix replaces the single-slash slice with lstrip('/') so both code paths agree.

RemediationAI

Vendor-released patch: upgrade Mako to 1.3.11 or later (pip install --upgrade 'Mako>=1.3.11'); the fix is commit e05ac61989a7fb9dd7dcde6cfd72dc48328719a3 and is documented in advisory GHSA-v92g-xgxw-vvmm (https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm). If you cannot upgrade immediately, the actionable compensating control is to stop passing untrusted input straight into TemplateLookup.get_template(): validate or allowlist template URIs, and reject or strip any URI whose normalized form begins with a slash or contains '..' before lookup (side effect: legitimate templates referenced with leading slashes must be normalized consistently). Where templates are served over HTTP, front the app with a server or proxy that normalizes double-slash paths (CPython's BaseHTTPRequestHandler already does this per gh-87389), accepting that this only closes the HTTP delivery path and not direct-API misuse. Running the process under least privilege limits which files an attacker can read but does not fix the traversal.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-49869 CRITICAL POC
10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-41205 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy