CVE-2026-102991

Summary

On Windows, a TemplateLookup URI beginning with a drive designator (e.g. C:/../../secret.txt or C:\..\..\secret.txt) bypasses the directory traversal check in Template.__init__, allowing reads of files outside the configured template directory.

This is a third, independent instance of the root cause behind CVE-2026-41205 (the // prefix) and CVE-2026-44307 (the backslash form). Both of those fixes normalized a separator spelling. Neither addressed the other way posixpath and ntpath disagree: the drive designator. Both prior fixes remain effective on their own terms; this variant survives them for an independent reason.

Details

The root cause is the same posixpath / os.path mismatch: resolution is done with posixpath, confinement is checked with os.path, which is ntpath on Windows.

# mako/lookup.py -- resolution
247:  srcfile = posixpath.normpath(posixpath.join(dir_, u))   # posixpath, always
248:  if os.path.isfile(srcfile):                             # ntpath on Windows

# mako/template.py -- confinement
268:  u_norm = os.path.normpath(u_norm)                       # ntpath on Windows
269:  if u_norm.startswith(".."):                             # never true for a drive URI

posixpath has no concept of a drive, so it treats C: as an ordinary path component; the .. segments pop C: and then escape the template root. ntpath, by contrast, splits the drive off and treats the remainder as rooted, discarding the .. entirely -- so the guard on line 269 inspects a string from which the evidence has already been removed:

| URI | ntpath.normpath (what the guard sees) | guard fires | |---|---|---| | //../secret.txt | ..\secret.txt | yes | | \..\secret.txt | ..\secret.txt | yes | | C:/../../secret.txt | C:\secret.txt | no |

Because the guard cannot fire for any URI beginning with a single-letter drive designator, the traversal is unconstrained, and its depth does not have to be guessed. posixpath.normpath() saturates excess .. segments at the root rather than erroring, so a URI carrying more .. than the template root is deep reaches the volume root and descends from there. A single fixed payload therefore works regardless of where the template directory sits:

template root = <base>/srv/app/templates

'C:/../../../../boot.ini'          -> reads <base>/boot.ini
'C:/' + '../'*40 + 'etc/hostname'  -> reads /etc/hostname   (no depth guess)
'C:/../../../../../etc/hostname'   -> TopLevelLookupException (wrong depth)

On Windows the equivalent is C:/../../../../../../../../Windows/win.ini, which reads that file for any template root depth. Only a target addressed relative to the template root needs the .. count to be exact; anything reachable from the volume root does not.

Affected code

• mako/template.py: Template.__init__() URI validation uses os.path.normpath(), which on Windows strips the drive and discards the .. segments before the startswith("..") guard is applied.
• mako/lookup.py: TemplateLookup.get_template() resolves with posixpath.normpath/posixpath.join, where C: is an ordinary component, then performs the existence check with os.path.isfile().

Reproduction

Windows is emulated with the technique already used by the project's own test suite (test/test_template.py:1398-1401):

import os, ntpath
os.path = ntpath

from mako.lookup import TemplateLookup
lookup = TemplateLookup(directories=["root/tpl"])

for uri in ["ok.html",
            "//../../secret.txt",
            "\\..\\..\\secret.txt",
            "../../secret.txt",
            "C:/../../../secret.txt",
            "C:\\..\\..\\..\\secret.txt",
            "d:/../../../secret.txt"]:
    try:
        t = lookup.get_template(uri)
        print(repr(uri), "-> filename=", t.filename, repr(t.render()))
    except Exception as e:
        print(repr(uri), "-> REFUSED", type(e).__name__)

Against 1.4.1, with a sentinel file…

Summary

On Windows, a TemplateLookup URI beginning with a drive designator (e.g. C:/../../secret.txt or C:\..\..\secret.txt) bypasses the directory traversal check in Template.__init__, allowing reads of files outside the configured template directory.

This is a third, independent instance of the root cause behind CVE-2026-41205 (the // prefix) and CVE-2026-44307 (the backslash form). Both of those fixes normalized a separator spelling. Neither addressed the other way posixpath and ntpath disagree: the drive designator. Both prior fixes remain effective on their own terms; this variant survives them for an independent reason.

Details

The root cause is the same posixpath / os.path mismatch: resolution is done with posixpath, confinement is checked with os.path, which is ntpath on Windows.

# mako/lookup.py -- resolution
247:  srcfile = posixpath.normpath(posixpath.join(dir_, u))   # posixpath, always
248:  if os.path.isfile(srcfile):                             # ntpath on Windows

# mako/template.py -- confinement
268:  u_norm = os.path.normpath(u_norm)                       # ntpath on Windows
269:  if u_norm.startswith(".."):                             # never true for a drive URI

posixpath has no concept of a drive, so it treats C: as an ordinary path component; the .. segments pop C: and then escape the template root. ntpath, by contrast, splits the drive off and treats the remainder as rooted, discarding the .. entirely -- so the guard on line 269 inspects a string from which the evidence has already been removed:

| URI | ntpath.normpath (what the guard sees) | guard fires | |---|---|---| | //../secret.txt | ..\secret.txt | yes | | \..\secret.txt | ..\secret.txt | yes | | C:/../../secret.txt | C:\secret.txt | no |

Because the guard cannot fire for any URI beginning with a single-letter drive designator, the traversal is unconstrained, and its depth does not have to be guessed. posixpath.normpath() saturates excess .. segments at the root rather than erroring, so a URI carrying more .. than the template root is deep reaches the volume root and descends from there. A single fixed payload therefore works regardless of where the template directory sits:

template root = <base>/srv/app/templates

'C:/../../../../boot.ini'          -> reads <base>/boot.ini
'C:/' + '../'*40 + 'etc/hostname'  -> reads /etc/hostname   (no depth guess)
'C:/../../../../../etc/hostname'   -> TopLevelLookupException (wrong depth)

On Windows the equivalent is C:/../../../../../../../../Windows/win.ini, which reads that file for any template root depth. Only a target addressed relative to the template root needs the .. count to be exact; anything reachable from the volume root does not.

Affected code

• mako/template.py: Template.__init__() URI validation uses os.path.normpath(), which on Windows strips the drive and discards the .. segments before the startswith("..") guard is applied.
• mako/lookup.py: TemplateLookup.get_template() resolves with posixpath.normpath/posixpath.join, where C: is an ordinary component, then performs the existence check with os.path.isfile().

Reproduction

Windows is emulated with the technique already used by the project's own test suite (test/test_template.py:1398-1401):

import os, ntpath
os.path = ntpath

from mako.lookup import TemplateLookup
lookup = TemplateLookup(directories=["root/tpl"])

for uri in ["ok.html",
            "//../../secret.txt",
            "\\..\\..\\secret.txt",
            "../../secret.txt",
            "C:/../../../secret.txt",
            "C:\\..\\..\\..\\secret.txt",
            "d:/../../../secret.txt"]:
    try:
        t = lookup.get_template(uri)
        print(repr(uri), "-> filename=", t.filename, repr(t.render()))
    except Exception as e:
        print(repr(uri), "-> REFUSED", type(e).__name__)

Against 1.4.1, with a sentinel file…

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.init() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.init() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.