Path Traversal Vulnerability in PyMdown Extensions for Python-Markdown

CVE-2026-61632

What is CVE-2026-61632?

A vulnerability exists in the PyMdown Extensions for Python-Markdown, specifically the b64 extension, where improper path handling allows attackers to exploit a path traversal issue. This vulnerability enables unauthorized access to arbitrary files by manipulating the src attribute of tags, allowing the inclusion of files located outside the designated base path. Files with certain image extensions can be read and their contents base64-encoded, potentially exposing sensitive information to users controlling the Markdown input. The issue has been resolved in version 11.0.

References