Mako, a Python template library, contains a path traversal flaw in TemplateLookup.get_template() before version 1.3.11. When a template URI begins with a double slash (//), two different slash‑stripping mechanisms diverge, allowing an attacker to craft a URI such as //../../../secret.txt that resolves outside the configured template directory. Any file readable by the running process can be retrieved and rendered as template content, exposing sensitive data to unauthenticated users. The weakness is a classic directory traversal (CWE‑22) and can lead to confidentiality compromise at a system level.

The vulnerability affects the Mako library distributed by the SQLAlchemy group. Any installation of Mako prior to version 1.3.11 is affected. Administrators should verify whether their applications depend on Mako and determine the exact version in use. The fix is implemented in Mako 1.3.11 and newer releases.

The CVSS score of 7.7 indicates a high severity impact. The EPSS score of less than 1% suggests that current exploitation activity is low but still possible. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit this flaw from a remote web application that trusts user-supplied URIs and forwards them to TemplateLookup.get_template(); the attack does not require elevated privileges and can retrieve any file readable by the application process.