Executive brief
Mako is a Python library used by developers to generate dynamic web pages and documents from templates. A security flaw allows attackers to bypass directory restrictions and access sensitive files on the server that should be private. This could lead to the exposure of system configuration files, credentials, or other confidential data if the application uses user-provided input to select templates.
Technical details
A path traversal vulnerability exists in Mako's TemplateLookup.get_template() due to inconsistent URI normalization. While TemplateLookup.get_template() strips all leading slashes using a regular expression, the Template class initialization only stripped a single leading slash. By providing a URI starting with a double slash (e.g., //../../etc/passwd), an attacker can bypass the directory traversal check because the resulting path is normalized to an absolute path that does not start with the expected parent directory. This allows for arbitrary file reads of any file accessible to the Python process. The issue is resolved in version 1.3.11 by using lstrip("/") to ensure consistent slash removal across both components.
Affected products
- SQLAlchemy Mako < 1.3.11
Timeline
- 2026-04-14: patched: Version 1.3.11 released
- 2026-04-15: advisory: GitHub Security Advisory published
- 2026-04-23: disclosed: CVE-2026-41205 published to NVD