8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44307

CVE-2026-44307: Mako: Path traversal via backslash URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. ....\ secret.txt) bypasses the directory traversal check in Template.init and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44307

CVE-2026-44307:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Mako	pip	<= 1.3.11	1.3.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal flaw specific to Windows environments where the Mako template engine is used. The root cause is an inconsistency in path separator handling between different parts of the library. The TemplateLookup.get_template function used posixpath to normalize template URIs, which treats backslashes (\) as regular characters, not path separators. However, the underlying file access check (os.path.isfile) on Windows correctly interprets backslashes as separators. This discrepancy allows an attacker to craft a URI like \..\..\secret.txt. The posixpath normalization in get_template and the startswith("..") check in Template.__init__ would fail to detect the traversal, but the filesystem would execute it, allowing the attacker to read files outside the designated template directory. The patch addresses this by explicitly replacing backslashes with forward slashes at the beginning of both TemplateLookup.get_template and Template.__init__, ensuring consistent path normalization across all platforms before any validation or file system operations occur.

Vulnerable functions

TemplateLookup.get_template

mako/lookup.py

On Windows, the function used `posixpath` for normalization, which does not treat backslashes as path separators. A malicious URI with backslashes (e.g., `\..\..\secret.txt`) would bypass traversal checks because `posixpath` treated it as a valid filename. The function would then use `os.path.isfile`, which on Windows interprets backslashes, leading to file access outside the intended template directory. The fix involves replacing backslashes with forward slashes before path processing.

Template.__init__

mako/template.py

The constructor performs a security check to prevent path traversal by checking if the normalized path starts with '..'. However, it called `os.path.normpath` on a URI that could contain backslashes. On Windows, `os.path.normpath('\..\..\secret.txt')` might resolve to a path that doesn't start with '..', bypassing the check while still allowing directory traversal at the filesystem level. The fix ensures backslashes are converted to forward slashes before this validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.