CVE-2026-41205High· 7.5▾ TwilightMako: Path traversal via double-slash URI prefix in TemplateLookup
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations:
Template.__init__ strips one leading / using if/sliceTemplateLookup.get_template() strips all leading / using re.sub(r"^\/+", "")When a URI like //../../../../etc/passwd is passed:
get_template() strips all / → ../../../../etc/passwd → file found via posixpath.join(dir_, u)Template.__init__ strips one / → /../../../../etc/passwd → normpath → /etc/passwd/etc/passwd.startswith(..) → False → check bypassedArbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template().
Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's BaseHTTPRequestHandler which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.
Changed Template.__init__ to use lstrip("/") instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.
mako < 1.3.11Upgrade to a patched release:
mako 1.3.11Connected by shared product, vendor, weakness, or advisory.