CVE-2026-41205

What it actually does

Mako versions prior to 1.3.11 contain a path traversal flaw in TemplateLookup.get_template() when a template URI begins with a double slash, such as //../../../secret.txt. Because slash normalization is handled inconsistently, attacker-controlled template names can escape the intended template directory and cause the application to read and render arbitrary files that are accessible to the application process. The impact is primarily confidentiality loss: source files, configuration files, credentials, environment-derived secrets written to disk, or other readable local files may be exposed through the application response. Integrity and availability impact are not expected from the vulnerability alone, but disclosed secrets may enable follow-on compromise.

Why it matters to the business

Applications using vulnerable Mako versions may unintentionally expose sensitive local files if they pass user-controlled input into template lookup logic. This can lead to leakage of application secrets, credentials, configuration data, source code, API keys, or other confidential files, potentially enabling broader account takeover, lateral movement, or data theft. Although the current EPSS score is low and it is not listed in CISA KEV, the issue is network-exploitable, requires no authentication in affected application patterns, and should be prioritized for internet-facing applications or services that dynamically select templates from request parameters.

How an attack unfolds

An attacker first identifies an endpoint or application feature that selects a Mako template based on user-supplied input, such as a path, page name, theme, email template, report template, or view parameter. If the application passes that value directly to TemplateLookup.get_template(), the attacker supplies a URI beginning with a double slash followed by traversal sequences, for example //../../../etc/passwd or a path targeting application configuration files. In vulnerable Mako releases, the URI normalization mismatch allows the lookup to escape the intended template directories. If the target file exists and is readable by the application process, Mako returns it as rendered template content or returns an error that may still disclose path and file handling details. The attacker iterates over likely file paths to extract secrets, source code, configuration files, or service credentials, then may use the disclosed data for follow-on access to databases, cloud services, source repositories, or administrative interfaces.

How to fix it

Upgrade Mako to version 1.3.11 or later wherever it is used directly or transitively through Python dependencies. If using pinned dependencies, update the relevant requirements.txt, pyproject.toml, poetry.lock, Pipfile.lock, or constraints files and rebuild affected artifacts. If immediate upgrade is not possible, ensure untrusted input is never passed directly to TemplateLookup.get_template(); map user-facing identifiers to a strict allowlist of known template names, reject absolute paths and values beginning with / or //, reject traversal sequences such as ../ after URL decoding, and constrain template lookup to fixed application-controlled directories. Run the application process with least-privilege file permissions so it cannot read secrets or unrelated system files. Avoid returning raw template-rendering errors to users, as errors may aid path discovery.

How to confirm the fix worked

Confirm that all deployed Python environments, containers, virtual environments, and build artifacts use Mako 1.3.11 or later by checking package inventories with commands such as pip show Mako, pip freeze, pipdeptree, poetry show mako, or software composition analysis tooling. Review application code for TemplateLookup.get_template() calls and verify that any variable passed to it is selected from an allowlist rather than taken directly from request parameters, route components, headers, cookies, or form fields. Test representative endpoints with double-slash traversal inputs such as //../../../etc/passwd or //../../../app/config.py in a non-production environment and verify that the request is rejected, normalized safely, or returns only an expected application error without file content. Confirm web and application logs show no successful responses containing local file contents for traversal-style requests.

Typical attack path

1. Discover an application endpoint that accepts a user-controlled template, page, view, theme, or file-like parameter.
2. Send benign requests to determine whether the parameter influences Mako template resolution or produces Mako-related errors.
3. Submit traversal payloads that begin with a double slash, such as //../../../, to escape the configured template directory.
4. Target readable local files such as application configuration files, source files, credential files, environment dumps written to disk, or operating-system files.
5. Review successful responses or error messages for sensitive content, file paths, secrets, or stack traces.
6. Use any exposed credentials or configuration details to access downstream systems or escalate the attack.

How to detect it

Review HTTP access logs, reverse-proxy logs, WAF events, application logs, and Python exception traces for requests containing template-selection parameters with double-slash traversal payloads. Focus on payloads that begin with // followed by ../ or URL-encoded traversal sequences, especially where the response status was 200, 206, 500, or unusually large compared with normal template responses. Search for attempts to retrieve common sensitive files such as /etc/passwd, /proc/self/environ, application settings files, .env files, cloud credential files, SSH keys, or source files. Application logs may show Mako exceptions, template lookup failures, or unexpected rendering of non-template files. If exploitation is suspected, compare request timestamps with outbound authentication events, cloud API activity, database logins, source-control access, or secret-use telemetry because the primary risk is credential disclosure and follow-on access. Preserve application logs and affected container or host filesystem metadata for forensic review.

• //../../../
• //../../../../
• //..%2f..%2f
• //%2e%2e%2f%2e%2e%2f
• //..%252f..%252f
• /etc/passwd
• /proc/self/environ
• /.env
• /config.py
• /settings.py
• /app.py
• /requirements.txt
• /pyproject.toml
• /root/.ssh/id_rsa
• /.aws/credentials
• TemplateLookup.get_template
• mako.lookup
• TopLevelLookupException
• Cant locate template
• Can't locate template

What your security team should do

• Inventory all applications and containers that include the Python Mako package, including transitive use through SQLAlchemy-related stacks or other frameworks.
• Prioritize upgrade to Mako 1.3.11 or later for internet-facing services, unauthenticated endpoints, and applications with dynamic template selection.
• Search code repositories for TemplateLookup.get_template and review whether any caller passes user-controlled input without an allowlist.
• Add input validation or routing changes so external users select templates only through fixed symbolic names, not filesystem-like paths.
• Harden runtime file permissions so application processes cannot read secrets, deployment keys, source repositories, or unrelated system files.
• Add WAF, reverse-proxy, or application-layer detections for double-slash path traversal patterns while patching is underway.
• Review historical logs for traversal payloads beginning with // and for responses that may have disclosed sensitive files.
• Ensure error handling suppresses stack traces and filesystem paths from user-facing responses.