Cloudanix VulnDB

GHSA-v92g-xgxw-vvmm

Medium · 5.3

Mako: Path traversal via double-slash URI prefix in TemplateLookup

CVSS

5.3

EPSS

—

Published

Apr 16, 2026

CISA due date

—

The record

`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations: - `Template.__init__` strips **one** leading `/` using `if`/slice - `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r"^\/+", "")` When a URI like `//../../../../etc/passwd` is passed: 1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)` 2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd` 3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities