{"id":"CVE-2026-41205","aliases":["GHSA-v92g-xgxw-vvmm","PYSEC-2026-88"],"url":"https://o3.security/vulnerability/CVE-2026-41205","summary":"Mako: Path traversal via double-slash URI prefix in TemplateLookup","details":"### Summary\n\n`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:\n\n- `Template.__init__` strips **one** leading `/` using `if`/slice\n- `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r\"^\\/+\", \"\")`\n\nWhen a URI like `//../../../../etc/passwd` is passed:\n1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)`\n2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd`\n3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**\n\n### Impact\n\nArbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.\n\nNote: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.\n\n### Fix\n\nChanged `Template.__init__` to use `lstrip(\"/\")` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.","published":"2026-04-23T18:52:24.194Z","modified":"2026-08-12T03:51:45.403931126Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"mako","fixedVersion":"1.3.11"}],"fix":{"url":"https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3","label":"sqlalchemy/mako@e05ac61"},"references":[{"type":"WEB","url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41205.json"},{"type":"ADVISORY","url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41205"},{"type":"FIX","url":"https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2026-88.yaml"},{"type":"PACKAGE","url":"https://github.com/sqlalchemy/mako"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:45.403931126Z"}}