https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:06:45 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10805 bdu:2026-10805 https://cve.radiocsirt.org/vuln/bdu:2026-10805 https://cve.radiocsirt.org/vuln/bell-cve-2026-44307 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2026-44307 https://cve.radiocsirt.org/vuln/brew-ansible-cmdb-cve-2026-44307 <p><strong>Affected:</strong> Homebrew: ansible-cmdb</p> <p>## Summary</p> <p>On Windows, a URI using backslash traversal (e.g. `\..\..\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.</p> <p>## Details</p> <p>The root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\` as a path separator, while `posixpath` treats it as a literal character.</p> <p>The vulnerability chain:</p> <p>1. `get_template()` strips only leading `/` via `re.sub(r&#34;^\/+&#34;, &#34;&#34;, uri)` and normalizes with `posixpath` — backslash `\` is treated as a literal character, so `\..\ secret.txt` passes through with `..` undetected. 2. `Template.__init__()` validation uses `os.path.normpath()` — on Windows this resolves `\..\ secret.txt` to `\secret.txt`, which does not start with `..`, so the `startswith(&#34;..&#34;)` check passes. 3. `os.path.isfile()` on Windows interprets `\` as a path separator, resolving the `..` traversal and finding files outside the template directory.</p> <p>### Affected code</p> <p>- `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()` for existence check - `mako/template.py`: `Template.__init__()` URI validation uses `os.path.normpath…</p> <p><strong>Affected:</strong> Homebrew: ansible-cmdb</p> <p>## Summary</p> <p>On Windows, a URI using backslash traversal (e.g. `\..\..\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.</p> <p>## Details</p> <p>The root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\` as a path separator, while `posixpath` treats it as a literal character.</p> <p>The vulnerability chain:</p> <p>1. `get_template()` strips only leading `/` via `re.sub(r&#34;^\/+&#34;, &#34;&#34;, uri)` and normalizes with `posixpath` — backslash `\` is treated as a literal character, so `\..\ secret.txt` passes through with `..` undetected. 2. `Template.__init__()` validation uses `os.path.normpath()` — on Windows this resolves `\..\ secret.txt` to `\secret.txt`, which does not start with `..`, so the `startswith(&#34;..&#34;)` check passes. 3. `os.path.isfile()` on Windows interprets `\` as a path separator, resolving the `..` traversal and finding files outside the template directory.</p> <p>### Affected code</p> <p>- `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()` for existence check - `mako/template.py`: `Template.__init__()` URI validation uses `os.path.normpath…</p> https://cve.radiocsirt.org/vuln/brew-ansible-cmdb-cve-2026-44307 https://cve.radiocsirt.org/vuln/cleanstart-2026-af67526 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: jupyterhub-k8s-hub</p> <p>Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: jupyterhub-k8s-hub</p> <p>Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-af67526 https://cve.radiocsirt.org/vuln/euvd-2026-318054 EUVD-2026-318054 https://cve.radiocsirt.org/vuln/euvd-2026-318054 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44307 <p>Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.</p> <p>Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44307 https://cve.radiocsirt.org/vuln/ghsa-2h4p-vjrc-8xpq <p><strong>Affected:</strong> PyPI: Mako</p> <p>## Summary</p> <p>On Windows, a URI using backslash traversal (e.g. `\..\..\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.</p> <p>## Details</p> <p>The root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\` as a path separator, while `posixpath` treats it as a literal character.</p> <p>The vulnerability chain:</p> <p>1. `get_template()` strips only leading `/` via `re.sub(r&#34;^\/+&#34;, &#34;&#34;, uri)` and normalizes with `posixpath` — backslash `\` is treated as a literal character, so `\..\ secret.txt` passes through with `..` undetected. 2. `Template.__init__()` validation uses `os.path.normpath()` — on Windows this resolves `\..\ secret.txt` to `\secret.txt`, which does not start with `..`, so the `startswith(&#34;..&#34;)` check passes. 3. `os.path.isfile()` on Windows interprets `\` as a path separator, resolving the `..` traversal and finding files outside the template directory.</p> <p>### Affected code</p> <p>- `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()` for existence check - `mako/template.py`: `Template.__init__()` URI validation uses `os.path.normpath…</p> <p><strong>Affected:</strong> PyPI: Mako</p> <p>## Summary</p> <p>On Windows, a URI using backslash traversal (e.g. `\..\..\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.</p> <p>## Details</p> <p>The root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\` as a path separator, while `posixpath` treats it as a literal character.</p> <p>The vulnerability chain:</p> <p>1. `get_template()` strips only leading `/` via `re.sub(r&#34;^\/+&#34;, &#34;&#34;, uri)` and normalizes with `posixpath` — backslash `\` is treated as a literal character, so `\..\ secret.txt` passes through with `..` undetected. 2. `Template.__init__()` validation uses `os.path.normpath()` — on Windows this resolves `\..\ secret.txt` to `\secret.txt`, which does not start with `..`, so the `startswith(&#34;..&#34;)` check passes. 3. `os.path.isfile()` on Windows interprets `\` as a path separator, resolving the `..` traversal and finding files outside the template directory.</p> <p>### Affected code</p> <p>- `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()` for existence check - `mako/template.py`: `Template.__init__()` URI validation uses `os.path.normpath…</p> https://cve.radiocsirt.org/vuln/ghsa-2h4p-vjrc-8xpq https://cve.radiocsirt.org/vuln/msrc_cve-2026-44307 msrc_CVE-2026-44307 https://cve.radiocsirt.org/vuln/msrc_cve-2026-44307 https://cve.radiocsirt.org/vuln/pysec-2026-2617 <p><strong>Affected:</strong> PyPI: mako</p> <p>## Summary</p> <p>On Windows, a URI using backslash traversal (e.g. `\..\..\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.</p> <p>## Details</p> <p>The root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\` as a path separator, while `posixpath` treats it as a literal character.</p> <p>The vulnerability chain:</p> <p>1. `get_template()` strips only leading `/` via `re.sub(r&#34;^\/+&#34;, &#34;&#34;, uri)` and normalizes with `posixpath` — backslash `\` is treated as a literal character, so `\..\ secret.txt` passes through with `..` undetected. 2. `Template.__init__()` validation uses `os.path.normpath()` — on Windows this resolves `\..\ secret.txt` to `\secret.txt`, which does not start with `..`, so the `startswith(&#34;..&#34;)` check passes. 3. `os.path.isfile()` on Windows interprets `\` as a path separator, resolving the `..` traversal and finding files outside the template directory.</p> <p>### Affected code</p> <p>- `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()` for existence check - `mako/template.py`: `Template.__init__()` URI validation uses `os.path.normpath…</p> <p><strong>Affected:</strong> PyPI: mako</p> <p>## Summary</p> <p>On Windows, a URI using backslash traversal (e.g. `\..\..\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.</p> <p>## Details</p> <p>The root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\` as a path separator, while `posixpath` treats it as a literal character.</p> <p>The vulnerability chain:</p> <p>1. `get_template()` strips only leading `/` via `re.sub(r&#34;^\/+&#34;, &#34;&#34;, uri)` and normalizes with `posixpath` — backslash `\` is treated as a literal character, so `\..\ secret.txt` passes through with `..` undetected. 2. `Template.__init__()` validation uses `os.path.normpath()` — on Windows this resolves `\..\ secret.txt` to `\secret.txt`, which does not start with `..`, so the `startswith(&#34;..&#34;)` check passes. 3. `os.path.isfile()` on Windows interprets `\` as a path separator, resolving the `..` traversal and finding files outside the template directory.</p> <p>### Affected code</p> <p>- `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()` for existence check - `mako/template.py`: `Template.__init__()` URI validation uses `os.path.normpath…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2617 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44307 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: mako, Ubuntu:Pro:18.04:LTS: mako, Ubuntu:Pro:20.04:LTS: mako, Ubuntu:22.04:LTS: mako, Ubuntu:24.04:LTS: mako, Ubuntu:25.10: mako, Ubuntu:26.04:LTS: mako</p> <p>Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: mako, Ubuntu:Pro:18.04:LTS: mako, Ubuntu:Pro:20.04:LTS: mako, Ubuntu:22.04:LTS: mako, Ubuntu:24.04:LTS: mako, Ubuntu:25.10: mako, Ubuntu:26.04:LTS: mako</p> <p>Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44307