CVE-2026-41205: Mako Template Library Path Traversal Flaw

CVE-2026-41205 Overview

CVE-2026-41205 is a Path Traversal vulnerability affecting the Mako template library for Python. Prior to version 1.3.11, the TemplateLookup.get_template() function is vulnerable to path traversal attacks when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations within the library.

This vulnerability allows attackers to read any file accessible by the process when an application passes untrusted input directly to TemplateLookup.get_template(). The file contents are then returned as rendered template content, potentially exposing sensitive configuration files, credentials, or other confidential data.

Critical Impact

Attackers can exploit this path traversal vulnerability to read arbitrary files from the server, potentially exposing sensitive data including configuration files, credentials, and application source code.

Affected Products

• Mako template library versions prior to 1.3.11
• Python applications using TemplateLookup.get_template() with untrusted input
• Web applications and services built with vulnerable Mako versions

Discovery Timeline

• April 23, 2026 - CVE-2026-41205 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41205

Vulnerability Analysis

This path traversal vulnerability (CWE-22) in the Mako template library arises from an inconsistency in how the library handles slash characters in URI paths. The TemplateLookup.get_template() function contains two separate implementations for stripping leading slashes from template URIs, and these implementations behave differently when processing URIs that begin with double slashes (//).

When an attacker supplies a malicious URI such as //../../../etc/passwd, the inconsistent slash-stripping logic fails to properly sanitize the path, allowing directory traversal sequences (../) to escape the intended template directory. This enables unauthorized access to files outside the designated template root.

The vulnerability is network-exploitable without requiring authentication or user interaction, making it particularly dangerous for web applications that accept template names or paths from user input.

Root Cause

The root cause is an inconsistency between two slash-stripping implementations within the Mako library's TemplateLookup class. When a URI begins with //, one implementation may strip only the first slash while another expects both to be removed, creating a mismatch that allows path traversal sequences to bypass the intended security controls. This implementation discrepancy means that carefully crafted URIs starting with // followed by traversal sequences can escape the template directory constraints.

Attack Vector

The attack vector is network-based, targeting web applications or services that pass user-controlled input to the TemplateLookup.get_template() function without proper validation. An attacker can craft a malicious URI starting with // followed by path traversal sequences (e.g., //../../../etc/passwd) to read arbitrary files accessible to the application process.

The vulnerability requires no authentication or special privileges, and the attack can be executed without any user interaction. Applications that dynamically resolve template paths based on URL parameters, form inputs, or API requests are particularly susceptible.

For detailed technical information about the vulnerability mechanism, see the GitHub Security Advisory.

Detection Methods for CVE-2026-41205

Indicators of Compromise

• HTTP requests containing URIs with // followed by ../ sequences targeting template endpoints
• Unusual file access patterns in application logs showing attempts to access files outside template directories
• Error messages or responses containing unexpected file content or system file data
• Web server logs showing requests with encoded path traversal patterns (e.g., %2F%2F..%2F..%2F)

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing //.. or similar path traversal patterns
• Monitor application logs for template loading errors or unexpected file access attempts
• Deploy file integrity monitoring on sensitive configuration files to detect unauthorized reads
• Use runtime application self-protection (RASP) solutions to detect path traversal attempts at the application layer

Monitoring Recommendations

• Enable verbose logging for the Mako template engine to track template resolution paths
• Configure SIEM alerts for patterns matching path traversal attempts in web request logs
• Monitor for unusual process file access patterns, particularly reads of system files like /etc/passwd or application configuration files
• Implement anomaly detection for template-related API endpoints to identify suspicious request patterns

How to Mitigate CVE-2026-41205

Immediate Actions Required

• Upgrade Mako to version 1.3.11 or later immediately
• Audit application code for any usage of TemplateLookup.get_template() with user-controlled input
• Implement input validation to reject URIs containing // or ../ sequences before passing to template functions
• Review access logs for any evidence of exploitation attempts

Patch Information

The vulnerability is fixed in Mako version 1.3.11. Organizations should upgrade to this version or later to remediate the vulnerability. The patch addresses the inconsistency in slash-stripping implementations to ensure proper handling of URIs starting with //.

For additional details on the fix, refer to the GitHub Security Advisory.

Workarounds

• Implement strict input validation to sanitize all user-provided template paths before passing to TemplateLookup.get_template()
• Use an allowlist approach for template names, only permitting known valid template identifiers
• Deploy a web application firewall (WAF) with rules to block requests containing path traversal patterns
• Run the application with minimal file system permissions to limit the impact of potential exploitation

# Upgrade Mako to the patched version
pip install --upgrade mako>=1.3.11

# Verify the installed version
pip show mako | grep Version