Every CVE Search/ Get API key

CVE-2026-41205

Mako: Path traversal via double-slash URI prefix in TemplateLookup

7.7 HighFix available

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.36%Up 0.3 points since Apr 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
CVE-2026-41205
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-25279 7.7

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
EUVD-2026-25279
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-v92g-xgxw-vvmm 7.7

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Summary

TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations:

  • Template.__init__ strips one leading / using if/slice
  • TemplateLookup.get_template() strips all leading / using re.sub(r"^\/+", "")

When a URI like //../../../../etc/passwd is passed:

  1. get_template() strips all / → ../../../../etc/passwd → file found via posixpath.join(dir_, u)
  2. Template.__init__ strips one / → /../../../../etc/passwd → normpath → /etc/passwd
  3. /etc/passwd.startswith(..) → False → check bypassed

Impact

Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template().

Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's BaseHTTPRequestHandler which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.

Fix

Changed Template.__init__ to use lstrip("/") instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.

Record
GHSA-v92g-xgxw-vvmm
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 7.7

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
CVE-2026-41205
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 7.7

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
CVE-2026-41205
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-41205 7.5

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
DEBIAN-CVE-2026-41205
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 12 moreShow less
OSVGHSA-v92g-xgxw-vvmm 7.7

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Summary

TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations:

  • Template.__init__ strips one leading / using if/slice
  • TemplateLookup.get_template() strips all leading / using re.sub(r"^\/+", "")

When a URI like //../../../../etc/passwd is passed:

  1. get_template() strips all / → ../../../../etc/passwd → file found via posixpath.join(dir_, u)
  2. Template.__init__ strips one / → /../../../../etc/passwd → normpath → /etc/passwd
  3. /etc/passwd.startswith(..) → False → check bypassed

Impact

Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template().

Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's BaseHTTPRequestHandler which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.

Fix

Changed Template.__init__ to use lstrip("/") instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.

Record
GHSA-v92g-xgxw-vvmm
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVPYSEC-2026-88 7.5

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
PYSEC-2026-88
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-41205 7.5

CVE-2026-41205 in mako - Patched by Root

Root has patched CVE-2026-41205 in the mako package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-41205
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-41205 7.7

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
UBUNTU-CVE-2026-41205
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-83606 No score

CVE-2026-41205 affecting package python-mako for versions less than 1.2.4-3

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Record
AZL-83606
Updated
2026-11-05
OSVCLSA-2026-1791547905 No score

Fix CVE(s): CVE-2026-41205

  • SECURITY UPDATE: path traversal via //-prefixed URI in TemplateLookup
    • debian/patches/CVE-2026-41205.patch: strip every leading / in Template()
    • CVE-2026-41205
  • debian/python-mako-doc.links: fix the dangling changelog symlinks
Record
CLSA-2026-1791547905
Updated
2026-11-02
OSVopenSUSE-SU-2026:10616-1 No score

python311-Mako-1.3.11-1.1 on GA media

These are all security issues fixed in the python311-Mako-1.3.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10616-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20645-1 No score

Security update for python-Mako

This update for python-Mako fixes the following issue:

  • CVE-2026-41205: Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal (bsc#1262716).
Record
openSUSE-SU-2026:20645-1
Updated
2026-11-02
OSVSUSE-SU-2026:1819-1 No score

Security update for python-Mako

This update for python-Mako fixes the following issue:

  • CVE-2026-41205: Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal (bsc#1262716).
Record
SUSE-SU-2026:1819-1
Updated
2026-11-02
OSVSUSE-SU-2026:1820-1 No score

Security update for python-Mako

This update for python-Mako fixes the following issue:

  • CVE-2026-41205: Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal (bsc#1262716).
Record
SUSE-SU-2026:1820-1
Updated
2026-11-02
OSVSUSE-SU-2026:21426-1 No score

Security update for python-Mako

This update for python-Mako fixes the following issue:

  • CVE-2026-41205: Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal (bsc#1262716).
Record
SUSE-SU-2026:21426-1
Updated
2026-11-02
OSVUSN-8234-1 No score

python-mako vulnerability

It was discovered that Mako incorrectly handled URIs with double-slash prefixes in TemplateLookup. A remote attacker could possibly use this issue to obtain sensitive information.

Record
USN-8234-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mako
PyPI
 through 1.3.10
1.3.11
python-mako
Azure Linux:3
 before 1.2.4-3
1.2.4-3
python-mako
TuxCare:Ubuntu:18.04
 before 1.0.7+ds1-1ubuntu0.2+tuxcare.els1
1.0.7+ds1-1ubuntu0.2+tuxcare.els1
python-mako-doc
TuxCare:Ubuntu:18.04
 before 1.0.7+ds1-1ubuntu0.2+tuxcare.els1
1.0.7+ds1-1ubuntu0.2+tuxcare.els1
python3-mako
TuxCare:Ubuntu:18.04
 before 1.0.7+ds1-1ubuntu0.2+tuxcare.els1
1.0.7+ds1-1ubuntu0.2+tuxcare.els1
mako
Debian:12
 All versions, plus listed versions
1.2.4+ds-11.2.4+ds-21.3.1-11.3.10-11.3.10-2
Show 8 moreShow less
1.3.10-31.3.2-11.3.5-11.3.5-1.11.3.6-11.3.8-11.3.8-21.3.9-1
 None known
mako
Debian:13
 All versions, plus listed versions
1.3.10-11.3.10-21.3.10-31.3.9-1
 None known
mako
Debian:14
 All versions, plus listed versions
1.3.10-11.3.10-21.3.10-31.3.9-1
 None known
mako
PyPI
 before 1.3.11, plus listed versions
0.1.00.1.10.1.100.1.20.1.3
Show 45 moreShow less
0.1.40.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.20.2.30.2.40.2.50.3.00.3.10.3.20.3.30.3.40.3.50.3.60.4.00.4.10.4.20.5.00.6.00.6.10.6.20.7.00.7.10.7.20.7.30.8.00.8.10.9.00.9.11.0.01.0.11.0.101.0.111.0.121.0.131.0.141.0.21.0.31.0.41.0.5
1.3.11
mako
Root:PyPI
 before 1.2.4+aikido.1
1.2.4+aikido.1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
mako
Ubuntu:Pro:16.04:LTS
 before 1.0.3+ds1-1ubuntu1+esm2, plus listed versions
1.0.2+ds1-11.0.3+ds1-11.0.3+ds1-1ubuntu11.0.3+ds1-1ubuntu1+esm1
1.0.3+ds1-1ubuntu1+esm2
mako
Ubuntu:Pro:18.04:LTS
 before 1.0.7+ds1-1ubuntu0.2+esm1, plus listed versions
1.0.7+ds1-11.0.7+ds1-1ubuntu0.2
1.0.7+ds1-1ubuntu0.2+esm1
mako
Ubuntu:Pro:20.04:LTS
 before 1.1.0+ds1-1ubuntu2.1+esm1, plus listed versions
1.0.7+ds1-11.1.0+ds1-11.1.0+ds1-1ubuntu11.1.0+ds1-1ubuntu21.1.0+ds1-1ubuntu2.1
1.1.0+ds1-1ubuntu2.1+esm1
mako
Ubuntu:22.04:LTS
 before 1.1.3+ds1-2ubuntu0.2, plus listed versions
1.1.3+ds1-21.1.3+ds1-2ubuntu0.1
1.1.3+ds1-2ubuntu0.2
mako
Ubuntu:24.04:LTS
 before 1.3.2-1ubuntu0.1, plus listed versions
1.2.4+ds-21.3.1-11.3.2-1
1.3.2-1ubuntu0.1
mako
Ubuntu:25.10
 before 1.3.9-1ubuntu0.1, plus listed versions
1.3.8-21.3.9-1
1.3.9-1ubuntu0.1
mako
Ubuntu:26.04:LTS
 before 1.3.10-3ubuntu0.1, plus listed versions
1.3.9-11.3.10-31.3.10-3build1
1.3.10-3ubuntu0.1
python-Mako
openSUSE:Tumbleweed
 before 1.3.11-1.1
1.3.11-1.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41205 is a high vulnerability (CVSS 7.7) in Sqlalchemy Mako, published April 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in mako 1.3.11.

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 27 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open