Bug 2461244 (CVE-2026-41205)

Summary: CVE-2026-41205 mako: Mako: Information disclosure via path traversal vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, aprice, bdettelb, dfreiber, doconnor, drow, ehelms, ggainey, ilpinto, jburrell, jkoehler, jsamir, juwatts, kgaikwad, lphiri, ltomasbo, mbarnett, mhulan, nmoumoul, oezr, osousa, pcreech, rchan, rhel-process-autobot, rjohnson, smallamp, teagle, tmalecek, vkumar, watson-tool-maintainers, ykashtan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Mako, a Python template library. This vulnerability, known as path traversal, allows an attacker to access files outside of the intended directory. By providing a specially crafted input to the TemplateLookup.get_template() function, a remote attacker can exploit an inconsistency in how the system handles URIs starting with //. This could lead to the disclosure of sensitive information from any file readable by the affected application.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-23 20:01:25 UTC
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.