Executive brief
PyMdown Extensions is a collection of tools for the Python-Markdown project, commonly used in documentation sites like MkDocs. A security flaw allows a specially crafted Markdown file to read sensitive files from the server that should be restricted. This could lead to the exposure of internal documentation or configuration files if an attacker can submit Markdown content to be processed by a build system.
Technical details
A path traversal vulnerability exists in the `pymdownx.snippets` extension due to an improper string-prefix containment check in `SnippetPreprocessor.get_snippet_path()`. When `restrict_base_path` is enabled, the code uses `filename.startswith(base)` to validate paths. Because it fails to enforce a directory boundary (e.g., by appending a trailing slash), an attacker can use a snippet directive to access sibling directories that share the same prefix as the base path (e.g., accessing 'docs_internal' when 'docs' is the base). This is a regression of CVE-2023-32309. The issue is fixed in version 10.21.3 by ensuring the prefix check includes the operating system's path separator.
Affected products
- facelessuser PyMdown Extensions >= 10.0.1, < 10.21.3
Timeline
- 2023-05-15: other: Vulnerability introduced in version 10.0.1 via PR #2039
- 2026-05-13: patched: Fixed in version 10.21.3
- 2026-07-16: advisory: CVE-2026-46338 published