CVE-2026-41205

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11
https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlalchemy:mako:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Mako es una biblioteca de plantillas escrita en Python. Antes de la versión 1.3.11, TemplateLookup.get_template() es vulnerable a salto de ruta cuando una URI comienza con // (p. ej., //.. / .. / .. / secret.txt). La causa raíz es una inconsistencia entre dos implementaciones de eliminación de barras diagonales. Cualquier archivo legible por el proceso puede ser devuelto como contenido de plantilla renderizado cuando una aplicación pasa entrada no confiable directamente a TemplateLookup.get_template(). Esta vulnerabilidad está corregida en la versión 1.3.11.

Information

Published : 2026-04-23 19:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41205

Mitre link : CVE-2026-41205

CVE.ORG link : CVE-2026-41205

JSON object : View

Products Affected

sqlalchemy

mako

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-41205", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41205", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T20:20:51.233790Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sqlalchemy", "product": "mako", "versions": [{"status": "affected", "version": "< 1.3.11"}]}]}], "published": "2026-04-23T19:17:29.270", "references": [{"url": "https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3", "source": "security-advisories@github.com"}, {"url": "https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11", "source": "security-advisories@github.com"}, {"url": "https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11."}, {"lang": "es", "value": "Mako es una biblioteca de plantillas escrita en Python. Antes de la versi\u00f3n 1.3.11, TemplateLookup.get_template() es vulnerable a salto de ruta cuando una URI comienza con // (p. ej., //.. / .. / .. / secret.txt). La causa ra\u00edz es una inconsistencia entre dos implementaciones de eliminaci\u00f3n de barras diagonales. Cualquier archivo legible por el proceso puede ser devuelto como contenido de plantilla renderizado cuando una aplicaci\u00f3n pasa entrada no confiable directamente a TemplateLookup.get_template(). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.3.11."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sqlalchemy:mako:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2653BBE1-C0D8-4375-8CC0-B7713D560924", "versionEndExcluding": "1.3.11"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}