PT-2026-38303 · Pypi · Mako

Published 2026-05-06 · Updated 2026-05-18 · CVE-2026-44307

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Mako (affected versions not specified)

Description On Windows, a path traversal issue exists where URIs using backslash traversal (e.g., ....secret.txt) can bypass directory traversal checks in Template. init and normalization in TemplateLookup.get template(). This occurs due to a mismatch between posixpath, which treats backslashes as literal characters, and os.path (specifically ntpath on Windows), which treats them as path separators. An attacker can exploit this by passing user-controlled template names or include paths to the get template() function, potentially leading to the disclosure of files outside the configured template directory. If the accessed file contains Mako or Python template syntax, it may be parsed and executed.

Recommendations Normalize backslashes to forward slashes early in the URI processing pipeline, before any path operations, to ensure consistent behavior across platforms.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CLEANSTART-2026-CR27895

CLEANSTART-2026-UO66475

CVE-2026-44307

ECHO-15A8-1150-DD0D

GHSA-2H4P-VJRC-8XPQ

Affected Products

Mako

References · 24

• https://cve.org/CVERecord?id=CVE-2026-44307 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44307 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-44307 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-UO66475 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2h4p-vjrc-8xpq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42304 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-CR27895 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44307 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44307 · Vendor Advisory
• https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7 · Note
• https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12 · Note
• https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq · Note
• https://github.com/sqlalchemy/mako/issues/435 · Note
• https://github.com/sqlalchemy/mako · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CR27895.json · Note