{"id":"CVE-2026-41205","aliases":["GHSA-v92g-xgxw-vvmm","PYSEC-2026-88"],"title":"Mako: Path traversal via double-slash URI prefix in TemplateLookup","summary":"Mako: Path traversal via double-slash URI prefix in TemplateLookup","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"mako","product":"mako","ecosystem":"pip","affected":["mako < 1.3.11"],"patched":["mako 1.3.11"],"published":"2026-04-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:03.377000392Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-v92g-xgxw-vvmm","references":[{"url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41205"},{"url":"https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2026-88.yaml"},{"url":"https://github.com/sqlalchemy/mako"},{"url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11"}],"tags":["osv","pip"],"epss":0.00361,"epssPercentile":0.298,"ingestedAt":"2026-09-12T03:13:01.729Z","slug":"CVE-2026-41205","body":"## Overview\n\n### Summary\n\n`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:\n\n- `Template.__init__` strips **one** leading `/` using `if`/slice\n- `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r\"^\\/+\", \"\")`\n\nWhen a URI like `//../../../../etc/passwd` is passed:\n1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)`\n2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd`\n3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**\n\n### Impact\n\nArbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.\n\nNote: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.\n\n### Fix\n\nChanged `Template.__init__` to use `lstrip(\"/\")` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.\n\n## Affected packages\n\n- `mako < 1.3.11`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mako 1.3.11`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}