Mako, a Python template library, contains a directory traversal flaw that can be triggered on Windows systems by providing a URI that includes backslash traversal sequences (for example, "\\..\\..\\secret.txt"). The vulnerability bypasses the traversal check performed in Template.__init__ and the subsequent posixpath-based normalization in TemplateLookup.get_template(), allowing unauthorized reading of files outside the intended template directory. This flaw is a classic file inclusion attack and can lead to disclosure of sensitive system files or other confidential data managed by the application.

The issue affects all installations of Mako older than version 1.3.12 that are deployed on Windows platforms. The library is distributed by SQLAlchemy. Users running a version prior to 1.3.12 are vulnerable.

The flaw carries a CVSS score of 8.7, indicating a high severity level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of an EPSS score does not diminish the potential for exploitation. Attackers can invoke the vulnerability remotely through web applications or services that accept user-supplied template names; the backslash path traversal technique exploits a Windows-specific limitation in the library's path handling logic. Given the high CVSS score and the possibility of remote exploitation, this vulnerability requires prompt remediation.