Fluid Attacks Database

Description

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	mako	=1.3.10-1 \|\| =1.3.10-2 \|\| =1.3.10-3 \|\| =1.3.9-1	-
debian 12	mako	=1.2.4+ds-1 \|\| =1.2.4+ds-2 \|\| =1.3.1-1 \|\| =1.3.10-1 \|\| =1.3.10-2 \|\| =1.3.10-3 \|\| =1.3.2-1 \|\| =1.3.5-1 \|\| =1.3.5-1.1 \|\| =1.3.6-1 \|\| =1.3.8-1 \|\| =1.3.8-2 \|\| =1.3.9-1	-
debian 13	mako	=1.3.10-1 \|\| =1.3.10-2 \|\| =1.3.10-3 \|\| =1.3.9-1	-
pypi	mako	>=0 <1.3.11	1.3.11
rpm rhel8	resource-agents	-	-

Aliases

1. CVE-2026-412052. NVD-2026-412053. OSV-DEBIAN-2026-412054. OSV-2026-412055. GHSA-v92g-xgxw-vvmm6. GCVE-2026-412057. SECURITY-TRACKER-CVE-2026-41205

References

1. https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm2. https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a33. https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2026-88.yaml4. https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.