CVE-2026-44307

High

Published: 12/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypassed the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory.

Risk Assessment

This vulnerability may lead to unauthorized access to system files, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update the Mako library to version 1.3.12 or later to mitigate this vulnerability.

Other vulnerabilities in Mako

CVE-2026-41205High
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with //. This can lead to any file readable by the process being returned as rendered template content.

Original NVD description (English source)

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.