CVE-2026-46338 Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
Attackers can read arbitrary files from sibling directories via path traversal in PyMdown Extensions when restrict_base_path is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-46338?
CVE-2026-46338 is a medium-severity path traversal vulnerability in facelessuser pymdown-extensions, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-46338?
3 open source packages ship an affected version, including pymdown-extensions. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pymdown-extensions PyPI | From 10.0.1 | 10.21.3 |
pymdown-extensions PyPI | From 10.0.1 | 10.21.3 |
pymdown-extensions PyPI | From 10.0.1 | 10.21.3 |
Products include Facelessuser Pymdown Extensions.
How do I fix CVE-2026-46338?
Upgrade pymdown-extensions to 10.21.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-46338 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46338 exists.
Other vulnerabilities in facelessuser pymdown-extensions
Sources
Also known as DEBIAN-CVE-2026-46338, GHSA-62q4-447f-wv8h, PYSEC-2026-2999, ROOT-APP-PYPI-CVE-2026-46338, UBUNTU-CVE-2026-46338.