Executive brief
PyMdown Extensions is a collection of extensions for the Python Markdown library. A vulnerability in its 'b64' extension allows an attacker to read sensitive files from the server's file system by including specially crafted image tags in Markdown content. This could lead to the unauthorized disclosure of internal files that have image-related file extensions.
Technical details
A path traversal vulnerability exists in the 'b64' extension of PyMdown Extensions due to improper validation of the 'src' attribute in <img> tags. The 'repl_path' function in 'pymdownx/b64.py' uses 'os.path.normpath' to resolve image paths without verifying if the resulting path remains within the configured 'base_path'. An attacker can use '../' sequences or absolute paths to reference files outside the intended directory. If the target file has a permitted image extension (.png, .jpg, .jpeg, .gif, .svg), the extension will read the file and embed its base64-encoded contents into the rendered HTML output. This issue is fixed in version 11.0.0.
Affected products
- facelessuser pymdown-extensions <= 10.21.3
Timeline
- 2026-07-10: disclosed
- 2026-07-24: advisory
- 2026-07-24: patched: Fixed in version 11.0.0