# Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

Mako's TemplateLookup on Windows mixes posixpath normalization with ntpath file access, letting backslash traversal URIs read files outside the template directory.

- Payout: Research
- Severity: high
- Program: Mako
- Found by: 0xHunSec
- Disclosed: 2026-05-06
- CVE: CVE-2026-44307
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-2h4p-vjrc-8xpq
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-2h4p-vjrc-8xpq
- Tags: area:web domain:web impact:data-leak impact:rce kind:research platform:ghsa sev:high tech:python technique:parser-differential technique:source-review vuln:path-traversal

**Target:** TemplateLookup.get_template() URI handling / Template.__init__ validation
**Root cause:** get_template() normalizes URIs with posixpath (backslash is literal) while Template.__init__ validates and os.path.isfile() resolves paths with ntpath on Windows (backslash is separator), so `\..\` traversal survives normalization and passes the startswith('..') guard.
**Steps:**
1. Pass a user-controlled template URI like `\..\..\ secret.txt` to `TemplateLookup.get_template()` on Windows.
2. get_template() strips leading `/` via `re.sub(r"^\/+", "", uri)` and normalizes with posixpath, leaving `..` undetected since `\` is literal.
3. Template.__init__() runs `os.path.normpath()` (ntpath) which resolves `\..\ secret.txt` to `\secret.txt`, so the `startswith("..")` check passes.
4. `os.path.isfile()` interprets `\` as separator, resolving the traversal and locating the file outside the template directory.
**How found:** Noticed the mismatch between posixpath-based URI normalization in get_template() and os.path (ntpath on Windows) used for validation and isfile(), then tested backslash traversal URIs.
**Exploitation:** An app that forwards user-controlled template names or include paths to TemplateLookup.get_template() on Windows can be tricked into loading and disclosing arbitrary readable files outside the template dir; if the file contains Mako/Python template syntax it may be parsed and executed.
**Escalation:** File disclosure escalates to template execution if the read file contains Mako/Python template syntax.
**Insight:** When a codebase mixes posixpath for URI normalization with os.path for filesystem checks, test platform-specific separators (`\` on Windows) as traversal primitives — the two libraries disagree on what a separator is.