{"id":"CVE-2026-44307","title":"mako: Mako: Information disclosure via directory traversal (CVE-2026-44307)","summary":"A flaw was found in Mako, a Python template library. A remote attacker could exploit a directory traversal vulnerability by crafting a Uniform Resource Identifier (URI) with backslash traversal. This bypasses security checks, allowing the …","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat Ceph Storage 7","affected":["ceph_storage 7","ceph_storage 8"],"patched":["mako 1.3.12"],"published":"2026-05-12","updated":"2026-10-23","sourceUpdated":"2026-10-23T17:12:52+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44307.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44307.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44307"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476894"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44307"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44307"},{"url":"https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7"},{"url":"https://github.com/sqlalchemy/mako/issues/435"},{"url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12"},{"url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq"},{"url":"https://github.com/sqlalchemy/mako"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00742,"epssPercentile":0.5445,"aliases":["GHSA-2h4p-vjrc-8xpq","PYSEC-2026-2617"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:51.322Z","slug":"CVE-2026-44307","body":"## Overview\n\nA flaw was found in Mako, a Python template library. A remote attacker could exploit a directory traversal vulnerability by crafting a Uniform Resource Identifier (URI) with backslash traversal. This bypasses security checks, allowing the attacker to read files outside the intended template directory, leading to information disclosure.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Ceph Storage 7, Red Hat Ceph Storage 8 · no fix planned: Red Hat Ceph Storage 7, Red Hat Ceph Storage 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44307.json)\n\n**mako: Mako: Information disclosure via directory traversal** — rated Moderate by Red Hat. Released 2026-05-12, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n\nNo fix planned:\n\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n\nNot affected:\n\n- Exploit Intelligence\n- Migration Toolkit for Applications 8\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Quay 3\n- Red Hat Satellite 6\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- This vulnerability is specific to Windows systems where backslash characters are interpreted as path separators. Red Hat products running on Linux are not susceptible to this path traversal because Linux does not treat backslash as a directory separator. For any application using Mako on Windows, validate user-controlled template names to reject backslash characters before passing them to TemplateLookup.get_template(). Upgrading to Mako 1.3.12 resolves this issue.\n\n## Package advisory (CVE-2026-44307)\n\nAffected packages:\n\n- `mako < 1.3.12`\n\nPatched in:\n\n- `mako 1.3.12`\n\nSource: https://osv.dev/vulnerability/GHSA-2h4p-vjrc-8xpq","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":228697,"id":"CVE-2026-44307","ts":1792844914920,"field":"cvss","old":null,"new":"5.9"},{"seq":228696,"id":"CVE-2026-44307","ts":1792844914920,"field":"severity","old":"high","new":"medium"}]}