Mako EUVD-2026-90363

Requires ALL of the following: (1) the deployment runs on Windows, because the bug arises from ntpath (os.path on Windows) splitting off a drive designator and absorbing '..' segments before the traversal check, whereas posixpath used by get_template() does not - Linux/macOS deployments are unaffected; (2) the application passes attacker-controlled data into TemplateLookup.get_template() or an include path (dynamic template names, include expressions); (3) the malicious URI (e.g. 'C:/../../../secrets/creds.txt') must reach the lookup un-normalized - the advisory notes raw URL paths are generally normalized, so the viable channels are query strings, form/JSON request bodies, route parameters, and dynamic include expressions; and (4) for code execution (not just file read) the targeted file must reside on the same volume, be process-readable, and contain valid Mako template syntax. Fixed in 1.4.2. Limiting factors: Windows-only, dependency on the application echoing raw user input into template resolution, and same-volume/process-readability constraints on the target file.

This is a genuine but moderate-priority issue, best characterized as a real-but-conditional flaw rather than an urgent widescale threat. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5) correctly captures the tension: it is remotely reachable and unauthenticated (PR:N), but carries AC:H because exploitation depends on several stars aligning - the deployment must be on Windows, the application must feed attacker-controlled data into a template name/include path, and the malicious drive-designator URI must survive the application's normalization (the advisory notes raw URL paths are usually normalized, so the realistic vectors are query strings, form/JSON bodies, route parameters, and dynamic include expressions). CISA SSVC aligns with this measured view: Exploitation=poc (proof-of-concept level, not active), Automatable=no (target-specific conditions prevent spray-and-pray), and Technical Impact=partial. SSVC 'poc' plus the released fix/tests indicates publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. Signals are internally consistent - no contradictions between CVSS, SSVC, and the description. The primary caveat is platform-scoping: this is exploitable ONLY on Windows deployments, and Mako is very frequently deployed on Linux where the posixpath/ntpath divergence does not exist, which materially shrinks the real-world exposed population below what the network-vector score alone suggests.

A Python web application running Mako on Windows passes a user-supplied value (e.g. a template name from a JSON body, route parameter, or dynamic include expression) into TemplateLookup.get_template(). An unauthenticated attacker submits a URI such as 'C:/../../../secrets/creds.txt'; because get_template() resolves with posixpath while the pre-fix traversal check normalized with ntpath (which absorbs the drive designator before the dot-dot check), the path escapes the template directory and the file is read back, and if that file contains Mako syntax it may be parsed and executed. Proof-of-concept-level exploitation is indicated by SSVC (poc) and the vendor's added regression tests demonstrating the bypass URIs.