---
id: CVE-2026-44307
title: 'mako: Mako: Information disclosure via directory traversal (CVE-2026-44307)'
summary: >-
  A flaw was found in Mako, a Python template library. A remote attacker could
  exploit a directory traversal vulnerability by crafting a Uniform Resource
  Identifier (URI) with backslash traversal. This bypasses security checks,
  allowing the …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: Red Hat Ceph Storage 7
affected:
  - ceph_storage 7
  - ceph_storage 8
patched:
  - mako 1.3.12
published: '2026-05-12'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T17:12:52+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44307.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44307.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44307'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2476894'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44307'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44307'
  - url: >-
      https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7
  - url: 'https://github.com/sqlalchemy/mako/issues/435'
  - url: 'https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12'
  - url: 'https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq'
  - url: 'https://github.com/sqlalchemy/mako'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00742
epssPercentile: 0.5445
aliases:
  - GHSA-2h4p-vjrc-8xpq
  - PYSEC-2026-2617
ecosystem: pip
ingestedAt: '2026-07-13T18:57:51.322Z'
---

## Overview

A flaw was found in Mako, a Python template library. A remote attacker could exploit a directory traversal vulnerability by crafting a Uniform Resource Identifier (URI) with backslash traversal. This bypasses security checks, allowing the attacker to read files outside the intended template directory, leading to information disclosure.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ceph Storage 7, Red Hat Ceph Storage 8 · no fix planned: Red Hat Ceph Storage 7, Red Hat Ceph Storage 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44307.json)

**mako: Mako: Information disclosure via directory traversal** — rated Moderate by Red Hat. Released 2026-05-12, updated 2026-10-23.

Affected:

- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8

No fix planned:

- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8

Not affected:

- Exploit Intelligence
- Migration Toolkit for Applications 8
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat Quay 3
- Red Hat Satellite 6

## Remediation

Fix deferred

Workarounds / mitigations:

- This vulnerability is specific to Windows systems where backslash characters are interpreted as path separators. Red Hat products running on Linux are not susceptible to this path traversal because Linux does not treat backslash as a directory separator. For any application using Mako on Windows, validate user-controlled template names to reject backslash characters before passing them to TemplateLookup.get_template(). Upgrading to Mako 1.3.12 resolves this issue.

## Package advisory (CVE-2026-44307)

Affected packages:

- `mako < 1.3.12`

Patched in:

- `mako 1.3.12`

Source: https://osv.dev/vulnerability/GHSA-2h4p-vjrc-8xpq