CVE-2026-102991: 
Python Análisis y mitigación de vulnerabilidades

CVE-2026-102991 is a path traversal vulnerability in the Mako Python template library affecting all versions prior to 1.4.2. On Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs using posixpath, while Template.__init__() in mako/template.py validates them using os.path (which resolves to ntpath on Windows). A URI beginning with a Windows drive designator (e.g., C:/../../../secret.txt) causes ntpath to absorb traversal segments before the dot-dot check, while posixpath resolution escapes the configured template directory. The vulnerability was reported by Eurico Nicacio under coordinated disclosure, published September 22, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, GitHub Advisory DB).

The root cause is a posixpath/ntpath mismatch (CWE-22) in Mako's template URI handling on Windows. In mako/lookup.py (line 247), TemplateLookup.get_template() resolves URIs with posixpath.normpath(posixpath.join(dir_, u)), which treats C: as an ordinary path component, allowing .. segments to escape the template root. In mako/template.py (line 268), the confinement guard normalizes with os.path.normpath() (i.e., ntpath on Windows), which strips the drive designator and treats the remainder as rooted — absorbing all .. segments before the startswith("..") check on line 269, so the guard never fires for drive-prefixed URIs. This is the third independent instance of the same posixpath/ntpath mismatch, following CVE-2026-41205 (double-slash prefix) and CVE-2026-44307 (backslash form). Because posixpath.normpath() saturates excess .. segments at the volume root, a single payload like C:/../../../../boot.ini reads volume-root-relative files regardless of template directory depth (Github Advisory, Mako Commit).

Successful exploitation allows an unauthenticated network attacker to read any file accessible to the application process on the same Windows volume as the template directory — including configuration files, credentials, source code, and OS files such as Windows/win.ini. If a targeted file contains Mako or Python template syntax, it may also be parsed and executed as a template, potentially escalating the impact to remote code execution. The vulnerability is limited to Windows environments and does not affect POSIX systems, but the file disclosure capability can serve as an initial foothold for further lateral movement or privilege escalation (Github Advisory, GitHub Advisory DB).

A proof-of-concept Python script is publicly available in the Mako security advisory, demonstrating the traversal by instantiating TemplateLookup locally and iterating through malicious drive-designator URIs (Github Advisory). The NVD SSVC assessment classifies exploitation status as "poc" with no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.356% (27th percentile), indicating a relatively low near-term exploitation probability. No threat actor attribution or CISA KEV catalog listing has been reported. The vulnerability is not automatable due to high attack complexity, requiring the attacker to identify an application that passes user-controlled input to TemplateLookup.get_template() (GitHub Advisory DB).

1. Reconnaissance: Identify Windows-hosted web applications using Mako < 1.4.2 that pass user-controlled input (query strings, form/JSON bodies, route parameters, or <%include file="${...}"/> expressions) to TemplateLookup.get_template().
2. Craft malicious URI: Construct a drive-designator path traversal payload such as C:/../../../Windows/win.ini or C:/ + ../ × 40 + etc/passwd (the latter works regardless of template directory depth due to posixpath saturation behavior).
3. Submit payload: Deliver the crafted URI through an accessible input vector — e.g., a query parameter (?template=C:/../../../secret.txt), a JSON body field, a route parameter, or a dynamic include expression in a template.
4. Bypass confinement check: Template.__init__() normalizes the URI with ntpath.normpath, which strips the drive designator and absorbs .. segments, so the startswith("..") guard on line 269 of mako/template.py never fires.
5. Trigger file read: TemplateLookup.get_template() resolves the URI with posixpath, treating C: as an ordinary component and escaping the template root, then reads and returns the target file's contents via t.render().
6. Escalate if possible: If the disclosed file contains Mako/Python template syntax (e.g., a config file with embedded expressions), the template engine parses and executes it, potentially achieving remote code execution (Github Advisory, GitHub Advisory DB).

• Network: Unusual HTTP requests containing drive-designator path patterns (e.g., C:/, C:\, d:/) in query strings, POST body parameters, or route segments targeting template-rendering endpoints.
• Logs: Application or web server logs showing template name parameters containing strings matching patterns like [A-Za-z]:[\/] followed by .. sequences; errors or exceptions from mako.exceptions.TemplateLookupException for unexpected URIs (indicating probing attempts).
• File System: Unexpected access timestamps on sensitive files outside the template directory (e.g., Windows\win.ini, boot.ini, application config files, .env files) coinciding with web request activity.
• Process: Python/application process reading files outside the configured template directory, observable via file access auditing (Windows Security Event Log Event ID 4663 with Object Access auditing enabled).

Upgrade Mako to version 1.4.2 or later, which fixes the issue by replacing os.path.normpath() with posixpath.normpath() in Template.__init__(), ensuring both the resolution and confinement sides use the same path module (Mako Release, Mako Commit). If immediate patching is not possible, restrict template resolution to an allowlist of known-safe template names and validate all user-supplied template URIs server-side to reject strings matching drive-designator patterns (e.g., [A-Za-z]:). On Windows deployments, be especially cautious with any input vector — query strings, form/JSON bodies, route parameters, and <%include file="${...}"/> expressions — that flows into TemplateLookup.get_template() (Github Advisory).

The vulnerability was reported by Eurico Nicacio under coordinated disclosure and published by Mako maintainer Mike Bayer (zzzeek) on September 22, 2026. The advisory notes this is the third independent instance of the same posixpath/ntpath mismatch root cause, following two prior CVEs (CVE-2026-41205 and CVE-2026-44307), suggesting a pattern of incremental path traversal bypass discoveries in the library. The Yocto Project security mailing list also referenced the advisory, indicating downstream embedded Linux ecosystem awareness (Github Advisory, Mako Issue).