Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

SummaryOn Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:\..\..\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory.This is a third, independent instance of the root...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

UBUNTU-CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

PT-2026-103522

Name of the Vulnerable Software and Affected Versions Mako versions prior to 1.4.2 Description On Windows, the TemplateLookup.get template function in mako/lookup.py resolves template URIs using posixpath, whereas Template. init in mako/template.py validates them using os.path which utilizes...