cbl-mariner python-mako vulnerabilities

Latest cbl-mariner python-mako CVEs

Newest publication first

1. CVE-2026-41205 Mako: Path traversal via double-slash URI prefix in TemplateLookup

   Published 2026-04-23

   High·CVSS 7.7 EPSS 0.36%

   Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.