CVE-2026-44307

A flaw was found in Mako, a Python template library. A remote attacker could exploit a directory traversal vulnerability by crafting a Uniform Resource Identifier (URI) with backslash traversal. This bypasses security checks, allowing the attacker to read files outside the intended template directory, leading to information disclosure.

This flaw is rated Moderate (CVSS 5.9) because exploitation requires high attack complexity (AC:H) — the path traversal is Windows-specific and depends on attacker-controlled template names being passed to Mako's TemplateLookup. Red Hat products are deployed on Linux where this vulnerability is not exploitable, as Linux does not interpret backslash as a directory separator. The Resource Optimization Service ships the affected Mako version but runs on Linux, limiting practical impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability is specific to Windows systems where backslash characters are interpreted as path separators. Red Hat products running on Linux are not susceptible to this path traversal because Linux does not treat backslash as a directory separator. For any application using Mako on Windows, validate user-controlled template names to reject backslash characters before passing them to TemplateLookup.get_template(). Upgrading to Mako 1.3.12 resolves this issue.