Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

SummaryOn Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:\..\..\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory.This is a third, independent instance of the root...

UBUNTU-CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...