CVE-2026-41205 Mako: Path traversal via double-slash URI prefix in TemplateLookup
Attackers can read arbitrary files by passing double-slash URIs to Mako's TemplateLookup, exposing sensitive data to anyone using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41205?
CVE-2026-41205 is a high-severity path traversal vulnerability in sqlalchemy mako, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.
Weakness: CWE-22
Which versions are affected by CVE-2026-41205?
3 open source packages ship an affected version, including mako and Mako. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mako PyPI | All versions | 1.3.11 |
mako PyPI | All versions | 1.3.11 |
Mako PyPI | All versions | 1.3.11 |
Linux distribution packages (1)
python-Mako openSUSE:Tumbleweed | All versions | 1.3.11-1.1 |
Products include Sqlalchemy Mako.
How do I fix CVE-2026-41205?
Upgrade mako to 1.3.11 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-41205 being exploited?
There is no known exploitation of CVE-2026-41205 in the wild and no public exploit code.
Sources
Also known as AZL-83606, CLEANSTART-2026-QL06505, CLEANSTART-2026-TN41416, CLSA-2026-1791547905, DEBIAN-CVE-2026-41205, ECHO-0e1e-5a56-ed2d and 16 more.