Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
Mako: Untrusted Files Can Be Accessed
GHSA-v92g-xgxw-vvmm
Summary
Mako's TemplateLookup can access any file readable by the process if given a specially crafted URL. This can happen if an application passes untrusted input to TemplateLookup.get_template(). To fix, update Mako to use a consistent method for handling leading slashes.
What to do
- Update mako to version 1.3.11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | mako |
<= 1.3.10 Fix: upgrade to 1.3.11
|
Original title
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Original description
### Summary
`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:
- `Template.__init__` strips **one** leading `/` using `if`/slice
- `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r"^\/+", "")`
When a URI like `//../../../../etc/passwd` is passed:
1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)`
2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd`
3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**
### Impact
Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.
Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.
### Fix
Changed `Template.__init__` to use `lstrip("/")` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.
`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:
- `Template.__init__` strips **one** leading `/` using `if`/slice
- `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r"^\/+", "")`
When a URI like `//../../../../etc/passwd` is passed:
1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)`
2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd`
3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**
### Impact
Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.
Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.
### Fix
Changed `Template.__init__` to use `lstrip("/")` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.
ghsa CVSS4.0
6.3
Vulnerability type
CWE-22
Path Traversal
Published: 16 Apr 2026 · Updated: 16 Apr 2026 · First seen: 16 Apr 2026