Threat database

A path traversal vulnerability (CVE-2026-41205) exists in python-Mako's TemplateLookup.get_template() method prior to version 1.3.11. This flaw allows unauthorized access to files outside the intended template directory by exploiting a double-slash URI prefix. The vulnerability has a high severity score of 7.5 and affects pwntools versions before 1.3.11 and 4.15.0_9. A security update fixing this issue is available.

CVE-2026-44307 is a path traversal vulnerability in the pwntools package affecting the Mako template engine on Windows via backslash URI in TemplateLookup. The vulnerability is addressed in py3-jupyterhub package version 5.4.6-r0, which includes security fixes. No known exploits are reported in the wild. The vulnerability has medium severity based on available information.