CVE-2026-102991

Name of the Vulnerable Software and Affected Versions Mako versions prior to 1.4.2

Description On Windows, the TemplateLookup.get template() function in mako/lookup.py resolves template URIs using posixpath, whereas Template. init () in mako/template.py validates them using os.path (which utilizes ntpath). A URI starting with a drive designator allows ntpath to absorb traversal segments before the leading dot-dot check, enabling posixpath resolution to escape the configured template directory. This can lead to the disclosure of process-readable files on the same volume. Additionally, if a targeted file contains Mako template syntax, it may be parsed and executed as a template. This occurs when an application passes attacker-controlled template names or include paths, which can be delivered via query strings, form or JSON bodies, route parameters, or dynamic include expressions.

Recommendations Update Mako to version 1.4.2.