CVE-2026-61632

A flaw was found in PyMdown Extensions. The b64 extension, used for inlining images in Markdown, is vulnerable to a path traversal issue. An attacker can craft untrusted Markdown with specially formed image source containing directory traversal sequences e.g., ../ or absolute paths. This allows t...

CVE-2026-61632 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...

Arbitrary file read vulnerability in email-ext

email-ext 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. No restrictions are placed on the image URLs that can be inlined. This allows attackers able to control the email content to specify file: URLs...