Control: tags -1 + fixed-upstream patch Hi,
The upstream fix for CVE-2026-41205 (released in Mako 1.3.11) is this commit: https://www.google.com/url?q=https://github.com/sqlalchemy/mako/commit/e05ac61989&source=gmail&ust=1793767385862000&sa=E "Fix path traversal via double-slash URI prefix in TemplateLookup" The code change is one line in mako/template.py. The commit also adds regression tests to test/test_lookup.py. - u_norm = self.uri - if u_norm.startswith("/"): - u_norm = u_norm[1:] + u_norm = self.uri.lstrip("/") u_norm = os.path.normpath(u_norm) Cause: only one leading slash was stripped, so "//../x" normalised to "/../x". That passed the startswith("..") check, and the lookup then read a file outside the configured template directory. Verified on the Debian 1.3.10-3 source with its debian/patches applied. The commit applies cleanly. I made a template directory with a file one level above it, then called TemplateLookup(directories=[root]).get_template(uri): uri 1.3.10-3 patched "/ok.txt" renders renders "/../secret.txt" rejected rejected "//../secret.txt" renders secret file TemplateLookupException "///../secret.txt" renders secret file TemplateLookupException Upstream test suite (pytest): unpatched: 468 passed, 47 skipped patched: 469 passed, 47 skipped (including the new regression test), 0 failed Either importing 1.3.11 or carrying this single commit as a patch would close the bug. Thanks!
