Opened 6 months ago

Closed 6 months ago

#23149 closed enhancement (fixed)

mako-1.3.11 (Python module)

Reported by: Bruce Dubbs Owned by: Joe Locash
Priority: normal Milestone: 13.1
Component: BOOK Version: git
Severity: medium Keywords:
Cc:

Description

New point version.

Change History (3)

comment:1 by Douglas R. Reno, 6 months ago 

1.3.11
Released: Tue Apr 14 2026
bug

    [bug] [template]

    Fixed issue in TemplateLookup where a URI with a double-slash prefix (e.g. //../../) 
could bypass the directory traversal check in Template, allowing reads of arbitrary 
files outside of the template directory. The issue was caused by an inconsistency in how 
leading slashes were stripped between TemplateLookup.get_template() and Template 
initialization.

    References: #434

This fixes a pretty important path traversal issue

comment:2 by Joe Locash, 6 months ago

Owner: changed from blfs-book to Joe Locash
Status: new → assigned

comment:3 by Joe Locash, 6 months ago

Resolution: → fixed
Status: assigned → closed

Fixed at fd8cbf30a6.

Note: See TracTickets for help on using tickets.