Security Bulletin:Mako Template Library Vulnerability: Backslash Traversal on Windows Prior to Version 1.3.12

Summary Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal e.g. \..\..\ secret.txt bypasses the directory traversal check in Template.init and the posixpath-based normalization in TemplateLookup.gettemplate, allowing reads of files outside...

dependabot-pip-mako-case-poc

Dependabot pip-updater: case-sensitive advisory name match Po...

CLEANSTART-2026-CR27895 Security fixes for CVE-2026-42304, CVE-2026-44307, ghsa-2h4p-vjrc-8xpq, ghsa-grgv-6hw6-v9g4 applied in versions: 4.3.5-r0

Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-44307 Mako: Path traversal via backslash URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal e.g. ....\ secret.txt bypasses the directory traversal check in Template.init and the posixpath-based normalization in TemplateLookup.gettemplate, allowing reads of files outside the...

adoc (>=0.1.0, <=0.1.5), adr (>=0.4.0, <=0.4.1) +254 more potentially affected by CVE-2026-44307 via mako (>=1.0.1, <=1.3.11)

mako PYPI version =1.0.1, =0.1.0, =0.4.0, =0.1.0.dev1, =1.0.4, =1.0.4, =0.0.4, =0.0.1, =0.7.0, =1.0.1, =0.1.2, =0.2.5 and more Source cves: CVE-2026-44307 Source advisory: MEND:CVE-2026-44307...

CVE-2026-44307 vulnerabilities

Vulnerabilities for packages: reflex, mlflow, pgadmin4-fips, airflow-core, pgadmin4, airflow, keep-fips, keep, mlflow-fips...

adoc (>=0.1.0, <=0.1.5), adr (>=0.4.0, <=0.4.1) +254 more potentially affected by CVE-2026-44307 via mako (>=1.0.1, <=1.3.11)

mako PYPI version =1.0.1, =0.1.0, =0.4.0, =0.1.0.dev1, =1.0.4, =1.0.4, =0.0.4, =0.0.1, =0.7.0, =1.0.1, =0.1.2, =0.2.5 and more Source cves: CVE-2026-44307 Source advisory: SNYK:PYTHON-MAKO-16439021...