CVE-2026-102991: Mako Path Traversal Vulnerability on Windows
Summary
CVE-2026-102991: Mako: Path traversal via drive-letter URI on Windows in TemplateLookup. Affects mako versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mako is a widely-used templating engine for Python, designed to provide a fast and lightweight way to generate dynamic web content. It allows developers to embed Python code within HTML, making it easier to create complex web applications. However, Mako has a vulnerability that affects its TemplateLookup functionality on Windows systems, allowing unauthorized file access through path traversal attacks.
Vulnerability Detail
On Windows, a TemplateLookup URI that begins with a drive letter (e.g., C:/../secret.txt) bypasses the directory traversal checks in the Template.init method. This vulnerability arises from a mismatch between posixpath and ntpath, where posixpath does not recognize drive letters as special components. As a result, attackers can exploit this flaw to read files outside the intended template directory, leading to potential local file disclosure and execution of malicious templates if the targeted files contain executable code.
How To Fix
Minimum fixed version
1.4.2
This is the first release that contains the fix.
pip install --upgrade "mako==1.4.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the URI validation in your code to ensure that both the resolution and confinement checks use the same path normalization method. Here is an example code snippet:
u_norm = posixpath.normpath(self.uri.replace("\\", "/").lstrip("/"))
if u_norm.startswith(".."):
raise exceptions.TemplateLookupException(...)
Conclusion
The Mako path traversal vulnerability (CVE-2026-102991) poses a significant risk for applications running on Windows. By understanding the nature of this vulnerability and applying the recommended fixes or workarounds, developers can protect their applications from potential exploitation.
See every vulnerability recorded for mako →
FAQ
The vulnerability allows path traversal on Windows systems, enabling unauthorized access to files outside the configured template directory.
Any application using Mako on Windows that allows user-controlled template names or include paths is at risk.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement the provided workaround to mitigate the risk until you can upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for mako.
