PyMdown Extensions' SnippetPreprocessor.get_snippet_path() method uses a string-prefix containment check for path restriction when restrict_base_path is set to True. This check is insufficient, allowing an attacker to craft markdown snippet directives that read files outside the intended restricted directory by exploiting sibling paths with the same base path prefix. This vulnerability affects versions >=10.0.1 and <10.21.3 and was introduced as a regression of CVE-2023-32309. The issue is resolved in version 10.21.3.

An attacker with the ability to control markdown snippet directives can read files from directories outside the intended restricted base path, potentially exposing sensitive information. The vulnerability does not allow modification or denial of service, only limited information disclosure. The CVSS score of 4.3 reflects a low-impact confidentiality loss with no integrity or availability impact.

Upgrade pymdown-extensions to version 10.21.3 or later, where this path traversal vulnerability is fixed. There is no official patch advisory provided, but the fix is included starting in 10.21.3. Until upgrading, avoid enabling restrict_base_path or restrict usage of markdown snippet directives from untrusted sources.