https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:40:14 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10804 bdu:2026-10804 https://cve.radiocsirt.org/vuln/bdu:2026-10804 https://cve.radiocsirt.org/vuln/brew-ansible-cmdb-cve-2026-41205 <p><strong>Affected:</strong> Homebrew: ansible-cmdb</p> <p>### Summary</p> <p>`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:</p> <p>- `Template.__init__` strips **one** leading `/` using `if`/slice - `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r&#34;^\/+&#34;, &#34;&#34;)`</p> <p>When a URI like `//../../../../etc/passwd` is passed: 1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)` 2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd` 3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**</p> <p>### Impact</p> <p>Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.</p> <p>Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python&#39;s `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.</p> <p>### Fix</p> <p>Changed `Template.__init__` to use `lstrip(&#34;/&#34;)` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.</p> <p><strong>Affected:</strong> Homebrew: ansible-cmdb</p> <p>### Summary</p> <p>`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:</p> <p>- `Template.__init__` strips **one** leading `/` using `if`/slice - `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r&#34;^\/+&#34;, &#34;&#34;)`</p> <p>When a URI like `//../../../../etc/passwd` is passed: 1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)` 2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd` 3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**</p> <p>### Impact</p> <p>Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.</p> <p>Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python&#39;s `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.</p> <p>### Fix</p> <p>Changed `Template.__init__` to use `lstrip(&#34;/&#34;)` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.</p> https://cve.radiocsirt.org/vuln/brew-ansible-cmdb-cve-2026-41205 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-319514 EUVD-2026-319514 https://cve.radiocsirt.org/vuln/euvd-2026-319514 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41205 <p>Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.</p> <p>Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41205 https://cve.radiocsirt.org/vuln/ghsa-v92g-xgxw-vvmm <p><strong>Affected:</strong> PyPI: Mako</p> <p>### Summary</p> <p>`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:</p> <p>- `Template.__init__` strips **one** leading `/` using `if`/slice - `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r&#34;^\/+&#34;, &#34;&#34;)`</p> <p>When a URI like `//../../../../etc/passwd` is passed: 1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)` 2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd` 3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**</p> <p>### Impact</p> <p>Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.</p> <p>Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python&#39;s `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.</p> <p>### Fix</p> <p>Changed `Template.__init__` to use `lstrip(&#34;/&#34;)` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.</p> <p><strong>Affected:</strong> PyPI: Mako</p> <p>### Summary</p> <p>`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:</p> <p>- `Template.__init__` strips **one** leading `/` using `if`/slice - `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r&#34;^\/+&#34;, &#34;&#34;)`</p> <p>When a URI like `//../../../../etc/passwd` is passed: 1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)` 2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd` 3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**</p> <p>### Impact</p> <p>Arbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.</p> <p>Note: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python&#39;s `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.</p> <p>### Fix</p> <p>Changed `Template.__init__` to use `lstrip(&#34;/&#34;)` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.</p> https://cve.radiocsirt.org/vuln/ghsa-v92g-xgxw-vvmm https://cve.radiocsirt.org/vuln/msrc_cve-2026-41205 msrc_CVE-2026-41205 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41205 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10616-1 <p>python311-Mako-1.3.11-1.1 on GA media</p> <p>python311-Mako-1.3.11-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10616-1 https://cve.radiocsirt.org/vuln/pysec-2026-88 <p><strong>Affected:</strong> PyPI: mako</p> <p>Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.</p> <p><strong>Affected:</strong> PyPI: mako</p> <p>Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.</p> https://cve.radiocsirt.org/vuln/pysec-2026-88 https://cve.radiocsirt.org/vuln/suse-su-2026:21426-1 <p>Security update for python-Mako</p> <p>Security update for python-Mako</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21426-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41205 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: mako, Ubuntu:Pro:18.04:LTS: mako, Ubuntu:Pro:20.04:LTS: mako, Ubuntu:22.04:LTS: mako, Ubuntu:24.04:LTS: mako, Ubuntu:25.10: mako, Ubuntu:26.04:LTS: mako</p> <p>Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: mako, Ubuntu:Pro:18.04:LTS: mako, Ubuntu:Pro:20.04:LTS: mako, Ubuntu:22.04:LTS: mako, Ubuntu:24.04:LTS: mako, Ubuntu:25.10: mako, Ubuntu:26.04:LTS: mako</p> <p>Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41205