CVE-2026-44307 Details

A path traversal vulnerability has been identified in the Mako template library for Python, affecting versions prior to 1.3.12. On Windows systems, URIs containing backslash traversal (such as '\..\secret.txt') can bypass directory traversal checks and the normalization process based on posixpath. This flaw allows unauthorized access to files outside the designated template directory. The issue arises because posixpath treats backslashes as literal characters, while Windows file handling interprets them as path separators, creating a loophole that can be exploited to read sensitive files.

Users can update to Mako version 1.3.12, which addresses the vulnerability by normalizing backslashes to forward slashes before any path operations, ensuring consistent behavior across different operating systems.