The b64 extension in PyMdown Extensions (up to and including version 10.21.3) improperly limits pathname resolution when inlining images referenced by <img src="..."> tags. It joins the src attribute onto a configured base_path using os.path.normpath but does not verify that the resolved path remains within base_path. This allows path traversal via '../' sequences or absolute paths to read files outside the base_path if they have allowed image extensions (.png, .jpg, .jpeg, .gif, .svg). The contents of these files are base64-encoded and included in the rendered Markdown output, potentially leaking sensitive file contents to anyone controlling the Markdown or viewing the output. This vulnerability is identified as CWE-22 and has a CVSS 3.1 score of 5.3 (medium severity). It is fixed in version 11.0.

An attacker who can supply Markdown content rendered with pymdownx.b64 enabled can read arbitrary files with allowed image extensions accessible to the process outside the intended base_path. This leads to information disclosure of file contents via base64 encoding in the rendered output. There is no impact on integrity or availability reported.

Upgrade PyMdown Extensions to version 11.0 or later where this path traversal vulnerability is fixed. Until then, avoid rendering untrusted Markdown with the pymdownx.b64 extension enabled. No official patch link or advisory is provided in the source data, so verify vendor advisories for confirmation.