CVE-2026-61632 facelessuser CVE debrief

Who should care

Developers and administrators using PyMdown Extensions, especially those rendering untrusted Markdown with pymdownx.b64 enabled, should be aware of this vulnerability and take necessary actions to update and protect their systems. Affected operators should review official advisories, assess deployments, and apply updates or mitigations as needed. Vulnerability management and security teams should monitor for potential exploitation attempts and verify affected assets.

Technical summary

The CVE-2026-61632 vulnerability is caused by a path traversal issue in PyMdown Extensions versions up to and including 10.21.3. The b64 extension inlines images referenced by <img src='...'> by joining the src onto the configured base_path with os.path.normpath and opening the result directly, without verifying that the resolved path stays inside base_path. This allows for the disclosure of arbitrary files with allowed image extensions (.png, .jpg, .jpeg, .gif, .svg) readable by the process. The issue has been fixed in version 11.0.

Defensive priority

Organizations using PyMdown Extensions should prioritize updating to version 11.0 to prevent potential file disclosure.

Recommended defensive actions

• Update PyMdown Extensions to version 11.0 or later
• Review and restrict usage of untrusted Markdown with pymdownx.b64 enabled
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-61632 issue is related to a path traversal vulnerability in PyMdown Extensions versions up to and including 10.21.3. The vulnerability allows for the disclosure of arbitrary files when the b64 extension is used to inline images referenced by <img src='...'>. The issue has been fixed in version 11.0. Evidence is limited to public CVE and NVD details. Defenders should verify affected deployments, review official advisories, and monitor for potential exploitation attempts within allowed image extension files.

Official resources