---
id: CVE-2026-41205
aliases:
  - GHSA-v92g-xgxw-vvmm
  - PYSEC-2026-88
title: 'Mako: Path traversal via double-slash URI prefix in TemplateLookup'
summary: 'Mako: Path traversal via double-slash URI prefix in TemplateLookup'
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: mako
product: mako
ecosystem: pip
affected:
  - mako < 1.3.11
patched:
  - mako 1.3.11
published: '2026-04-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:03.377000392Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-v92g-xgxw-vvmm'
references:
  - url: 'https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41205'
  - url: >-
      https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2026-88.yaml
  - url: 'https://github.com/sqlalchemy/mako'
  - url: 'https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11'
tags:
  - osv
  - pip
epss: 0.0053
epssPercentile: 0.42294
ingestedAt: '2026-09-12T03:13:01.729Z'
---

## Overview

### Summary

`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:

- `Template.__init__` strips **one** leading `/` using `if`/slice
- `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r"^\/+", "")`

When a URI like `//../../../../etc/passwd` is passed:
1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)`
2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd`
3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**

### Impact

Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.

Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.

### Fix

Changed `Template.__init__` to use `lstrip("/")` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.

## Affected packages

- `mako < 1.3.11`

## Remediation

Upgrade to a patched release:

- `mako 1.3.11`