Path traversal in Mako - CVE-2026-41205

Vulnerability identifier: #VU128398

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-41205

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in TemplateLookup.get_template() when processing a URI that starts with a double-slash prefix. A remote attacker can supply a specially crafted template URI to disclose sensitive information.

Exploitation requires an application to pass untrusted input directly to the vulnerable API, and HTTP-based exploitation depends on a server that does not normalize double-slash-prefixed paths.

Mako
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
openSUSE Leap
Ubuntu
mako (Ubuntu package)
python3-Mako
python311-Mako
InfoSphere Optim Archive Viewer

Install security update from vendor's website.

Mako - update to 1.3.11
mako (Ubuntu package) - addressed in versions 1.0.3+ds1-1ubuntu1+esm2, 1.0.7+ds1-1ubuntu0.2+esm1, 1.1.0+ds1-1ubuntu2.1+esm1, 1.1.3+ds1-2ubuntu0.2, 1.3.2-1ubuntu0.1, 1.3.9-1ubuntu0.1, 1.3.10-3ubuntu0.1
python3-Mako - update to 1.0.7-150000.3.6.1
python311-Mako - update to 1.3.0-150600.3.3.1
InfoSphere Optim Archive Viewer - update to 11.7.0.14

• https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm
• https://github.com/advisories/GHSA-v92g-xgxw-vvmm

• Path traversal in Mako
• Ubuntu update for mako
• SUSE update for python-Mako
• SUSE update for python-Mako
• IBM InfoSphere Optim Archive Viewer update for Mako