Executive brief
Mako is a popular Python library used to generate web pages and other text documents from templates. A security flaw in how the library handles file paths on Windows systems allows an attacker to bypass security checks and read sensitive files from the server. This could lead to the exposure of configuration files, source code, or other private data if the application allows user-controlled input to determine which template to load.
Technical details
A path traversal vulnerability exists in Mako's template resolution logic when running on Windows. The root cause is an inconsistency between 'posixpath' (used for URI normalization) and 'os.path' (which defaults to 'ntpath' on Windows). While 'posixpath' treats backslashes as literal characters, 'ntpath' and the underlying Windows file system treat them as path separators. An attacker can use backslash-based traversal sequences (e.g., '\..\') to bypass 'startswith("..")' security checks and 'posixpath.normpath' filters. This allows unauthorized reading of files outside the designated template directory. The issue is resolved in version 1.3.12 by normalizing backslashes to forward slashes early in the URI processing pipeline.
Affected products
- SQLAlchemy Mako < 1.3.12
Timeline
- 2026-04-28: patched: Fix committed and version 1.3.12 released.
- 2026-05-12: advisory: NVD and GitHub Security Advisory published.