Path Traversal in Sqlalchemy Mako
CVE-2026-102991
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Sqlalchemy Mako — versions < 1.4.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-102991?
- CVE-2026-102991 is a medium-severity vulnerability in Sqlalchemy Mako, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-09-30.
- How severe is CVE-2026-102991?
- Medium severity. CVSS v3 base score is 6.5 out of 10.