CVE-2026-102991 sqlalchemy CVE debrief

Who should care

Defenders responsible for Mako-based applications, particularly those using Windows deployments, should assess exposure and verify the Mako version to ensure it is 1.4.2 or later. This involves reviewing the current Mako version in use, understanding the potential impact of the vulnerability on their systems, and taking appropriate actions to mitigate the risk. Additionally, defenders should review and restrict template directory configurations to prevent

Why it matters

Defenders should care about this vulnerability as it allows potential file reads outside the template directory on Windows deployments of Mako, which could lead to data exposure or leakage. The vulnerability requires verification of the Mako version and patch application to prevent potential attacks.

• Potential unauthorized file reads outside the template directory
• Possible data exposure or leakage
• Need for verification of Mako version and patch application
• Potential for attackers to access sensitive files

Technical summary

The vulnerability exists due to the use of different path modules for resolution and confinement checks in the Mako template engine on Windows. Specifically, `posixpath` is used for path resolution, while `os.path` (which is `ntpath` on Windows) is used for confinement checks. This discrepancy allows a drive-letter URI to bypass the directory traversal check, potentially allowing reads of files outside the configured template directory.

Defensive priority

Defenders should prioritize verifying the Mako version and applying the patch to prevent potential file reads outside the template directory.

Recommended defensive actions

• Verify the Mako version and upgrade to 1.4.2 or later
• Review and restrict template directory configurations
• Monitor for suspicious file access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability arises from a mismatch between `posixpath` and `os.path` (which is `ntpath` on Windows) in the Mako template engine. The `posixpath` module is used for path resolution, while `os.path` is used for confinement checks. This discrepancy allows a drive-letter URI to bypass the directory traversal check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.