Opened 5 months ago

Closed 5 months ago

#23213 closed enhancement (fixed)

mako-1.3.12 (Python module)

Reported by: Bruce Dubbs Owned by: Joe Locash
Priority: normal Milestone: 13.1
Component: BOOK Version: git
Severity: medium Keywords:
Cc:

Description

New point version.

Change History (2)

comment:1 by Joe Locash, 5 months ago

Owner: changed from blfs-book to Joe Locash
Status: new → assigned

comment:2 by Joe Locash, 5 months ago

Resolution: → fixed
Status: assigned → closed 
1.3.12

Released: Tue Apr 28 2026
        Fixed issue in :class:`.TemplateLookup` where a URI with backslash path
        separators (e.g. ``\..\secret.txt``) could bypass the directory traversal
        check on Windows, allowing reads of arbitrary files outside of the template
        directory.  Backslash characters in URIs are now normalized to forward
        slashes before path resolution.

Fixed at e6dae9e9c9.

Note: See TracTickets for help on using tickets.