PT-2026-34725 · Pypi+2 · Mako+2

0Xhunsec · Published 2026-04-16 · Updated 2026-05-20 · CVE-2026-41205

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mako versions prior to 1.3.11

Description Mako is a template library written in Python. The get template() function within TemplateLookup is susceptible to path traversal when a URI begins with //. This occurs due to an inconsistency between two slash-stripping implementations. If an application passes untrusted input directly to get template(), any file readable by the process can be returned as rendered template content.

Recommendations Update to version 1.3.11.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41205

ECHO-0E1E-5A56-ED2D

GHSA-V92G-XGXW-VVMM

OPENSUSE-SU-2026:10616-1

PYSEC-2026-88

USN-8234-1

Affected Products

Linuxmint

Mako

Ubuntu

References · 19

• https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8234-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-88 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8234-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41205 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41205 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41205 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v92g-xgxw-vvmm · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41205 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41205 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41205 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10616-1 · Vendor Advisory
• https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3 · Note
• https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11 · Note
• https://github.com/sqlalchemy/mako · Note