PT-2026-59270 · Pypi · Mako

Published

2026-07-13

·

Updated

2026-07-13

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

On Windows, a URI using backslash traversal (e.g. .... secret.txt) bypasses the directory traversal check in Template. init and the posixpath-based normalization in TemplateLookup.get template(), allowing reads of files outside the configured template directory.

Details

The root cause is a mismatch between posixpath (used for URI normalization in get template()) and os.path (used for file access via os.path.isfile() and validation via os.path.normpath() in Template. init ). On Windows, os.path is ntpath, which treats `` as a path separator, while posixpath treats it as a literal character.
The vulnerability chain:
  1. get template() strips only leading / via re.sub(r"^/+", "", uri) and normalizes with posixpath — backslash `` is treated as a literal character, so .. secret.txt passes through with .. undetected.
  2. Template. init () validation uses os.path.normpath() — on Windows this resolves .. secret.txt to secret.txt, which does not start with .., so the startswith("..") check passes.
  3. os.path.isfile() on Windows interprets `` as a path separator, resolving the .. traversal and finding files outside the template directory.

Affected code

  • mako/lookup.py: TemplateLookup.get template() uses posixpath.normpath/posixpath.join for path construction but os.path.isfile() for existence check
  • mako/template.py: Template. init () URI validation uses os.path.normpath() which on Windows resolves backslash traversal to a form that passes the startswith("..") guard

Impact

If an application passes user-controlled template names or include paths to TemplateLookup.get template(), an attacker on Windows may be able to load and disclose readable files outside the configured template directory. The primary impact is local file disclosure. If the targeted file contains Mako/Python template syntax, it may also be parsed and executed as a template.

Remediation

The fix should normalize backslashes to forward slashes early in the URI processing pipeline, before any path operations, to ensure consistent behavior across platforms.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2617

Affected Products

Mako