{"id":"CVE-2026-44307","published":"2026-05-12T21:53:52Z","modified":"2026-05-13T15:00:13Z","title":"Mako: Path traversal via backslash URI on Windows in TemplateLookup","vendor":"sqlalchemy","product":"mako","tier":"tail","description":{"text":"Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \\..\\..\\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00742,"percentile":0.54512,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/sqlalchemy/mako/issues/435","tags":["x_refsource_MISC"]},{"url":"https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7","tags":["x_refsource_MISC"]},{"url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12","tags":["x_refsource_MISC"]}],"priority":{"score":17.0,"factors":[{"name":"EPSS percentile","points":10.9},{"name":"CVSS severity","points":6.09}]},"vendorSlug":"sqlalchemy","affectedVersions":[{"vendor":"sqlalchemy","product":"mako","versions":["< 1.3.12"]}],"affected":[{"ecosystem":"PyPI","package":"Mako","vulnerableRanges":["<1.3.12"],"patched":["1.3.12"],"from":["GHSA-2h4p-vjrc-8xpq","PYSEC-2026-2617"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-29867","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sqlalchemy-mako-cve-2026-41205","packageHistory":[{"cve":"CVE-2026-41205","published":"2026-04-23","fixed":"1.3.11","kev":false,"link":{"from":"CVE-2026-41205","to":"CVE-2026-44307","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Mako","fromFixed":"1.3.11","toFixed":"1.3.12","daysApart":19},{"kind":"similar","provenance":"machine","score":0.6,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-44307","published":"2026-05-12","fixed":"1.3.12","kev":false},{"cve":"CVE-2026-102991","published":"2026-09-30","fixed":"1.4.2","kev":false,"link":{"from":"CVE-2026-44307","to":"CVE-2026-102991","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Mako","fromFixed":"1.3.12","toFixed":"1.4.2","daysApart":141},{"kind":"similar","provenance":"machine","score":0.55,"basis":"same product + CWE + description similarity"}]}}],"package":"PyPI:Mako"}}