AZL-83606
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-83606.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-83606
- Upstream
- Published
- 2026-04-23T19:17:29Z
- Modified
- 2026-08-28T17:47:56.765929670Z
- Summary
- CVE-2026-41205 affecting package python-mako for versions less than 1.2.4-3
- Details
-
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.gettemplate() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.gettemplate(). This vulnerability is fixed in 1.3.11.
- References