Bug 2501448 (CVE-2026-46338)

Summary: CVE-2026-46338 pymdown-extensions: PyMdown Extensions: Information disclosure via crafted Markdown snippets
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, alizardo, dschmidt, jchui, jhe, jlanda, kshier, ktsao, nboldt, oaljalju, psrna, simaishi, stcannon, teagle, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in PyMdown Extensions, a tool used for processing Markdown documents. This vulnerability allows an attacker to potentially read sensitive files from unexpected locations on a system. By crafting a special Markdown snippet, an attacker could trick the system into accessing files outside of the intended directory, leading to unauthorized information disclosure. This issue requires user interaction, meaning a user would need to process a malicious Markdown file for the attack to succeed.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-16 19:01:28 UTC 
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.