The vulnerability in facelessuser's pymdown-extensions affects the SnippetPreprocessor.get_snippet_path() method in pymdownx/snippets.py when restrict_base_path is set to True. The method uses a string-prefix containment check that is insufficient to properly restrict file access to the intended base directory. This allows an attacker to craft markdown snippet directives that read files from sibling directories sharing the same base_path prefix, effectively enabling path traversal. This regression reintroduces a previously fixed issue (CVE-2023-32309). The vulnerability affects versions from 10.0.1 up to but not including 10.21.3 and was resolved in version 10.21.3.

An attacker can read files outside the intended restricted directory by exploiting the path traversal vulnerability in the snippet processing feature. This can lead to unauthorized disclosure of sensitive files accessible to the application user. The CVSS score of 4.3 reflects a medium impact primarily on confidentiality, with no impact on integrity or availability. There are no known exploits in the wild at this time.

Upgrade pymdown-extensions to version 10.21.3 or later, where this path traversal vulnerability has been fixed. Since the vendor advisory indicates the issue is resolved in 10.21.3, applying this official fix is the recommended remediation. No other mitigation or temporary workaround is documented.