PyMdown Extensions is a set of extensions for the Python‑Markdown markdown project. From releases 10.0.1 through 10.21.3, the snippet extension (pymdownx.snippets) uses a string‑prefix containment check in SnippetPreprocessor.get_snippet_path() when restrict_base_path is True, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This regression of CVE‑2023‑32309 introduces a path‑traversal bypass that can lead to disclosure of arbitrary files within these sibling directories. The issue is fixed by upgrading to version 10.21.3 or newer.

The vulnerability affects the Python package facelessuser:pymdown-extensions, specifically the snippet extension component pymdownx.snippets. All installations within the affected version range (10.0.1–10.21.3) are impacted. Deployments using version 10.21.3 or newer are no longer vulnerable.

Based on the description, it is inferred that the attacker must supply malicious markdown content that the application processes to exploit this path traversal. The risk is moderate: the flaw permits local file disclosure rather than remote code execution and requires the attacker to supply markdown content that the application processes. The CVSS score of 4.3 reflects this moderate severity, while the EPSS score of < 1 % indicates a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Administrators should consider the confidentiality risk, particularly if the markdown rendering process runs with elevated privileges or processes untrusted content on a web server.