Path Traversal Vulnerability in Mako Template Library by SQLAlchemy
CVE-2026-41205

7.7HIGH

Key Information:

Vendor

Sqlalchemy

Status
Mako
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41205?

The Mako template library for Python is susceptible to a path traversal vulnerability in its TemplateLookup.get_template() method prior to version 1.3.11. This issue arises when the URI used begins with double slashes (//), leading to unintended file retrieval due to inconsistent implementations of slash-stripping functions. As a result, malicious users can exploit this flaw, allowing access to any readable file by the process, potentially exposing sensitive data. This vulnerability is addressed in version 1.3.11 and underscores the importance of validating user inputs when passing them to the template rendering process.

Affected Version(s)

mako < 1.3.11

References

https://github.com/sqlalchemy/mako/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.