Threat database

CVE-2026-102991 is a path traversal vulnerability in the Mako template library for Python, affecting versions prior to 1.4.2 on Windows. The issue arises because TemplateLookup.get_template() uses posixpath to resolve template URIs, while Template.__init__() validates them with os.path (ntpath on Windows). This mismatch allows crafted template URIs with drive designators to bypass directory restrictions, potentially exposing readable files and enabling execution of attacker-controlled templates. The vulnerability is fixed in version 1.4.2.

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.