CVE-2026-41205: Mako: Path traversal via double-slash URI prefix in TemplateLookup
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.gettemplate() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.gettemplate(). This vulnerability is fixed in 1.3.11.
Other sources
Mako: Path traversal via double-slash URI prefix in TemplateLookup
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41205?
CVE-2026-41205 is classified as a critical vulnerability due to its potential for significant unauthorized access to sensitive files.
How do I fix CVE-2026-41205?
To mitigate CVE-2026-41205, upgrade Mako to version 1.3.11 or later in your Python environment.
What types of systems are affected by CVE-2026-41205?
CVE-2026-41205 affects applications that utilize Mako versions prior to 1.3.11 within their templating framework.
What is the cause of CVE-2026-41205?
CVE-2026-41205 is caused by a path traversal vulnerability in TemplateLookup when a URL begins with a double-slash prefix.
Can CVE-2026-41205 lead to data breaches?
Yes, if exploited, CVE-2026-41205 could allow attackers to access sensitive files, leading to potential data breaches.