The b64 extension in PyMdown Extensions performs image inlining by simply concatenating the <img src> value to a configured base_path, normalizing it, and opening the result as a file. The code does not verify that the resulting path stays within the intended base directory. Consequently, an attacker can supply a src containing "../" sequences or an absolute path to read any file with an allowed image extension that is accessible to the process. The file's contents are base64-encoded and inserted into the markdown output, allowing the attacker to exfiltrate the file contents. The weakness is a classic path traversal flaw (CWE‑22) that enables a bounded file‑read attack against the application, impacting confidentiality but not directly denying service or executing code.

PyMdown Extensions is bundled with the Python‑Markdown project. The vulnerability exists in all releases up to and including 10.21.3. Versions from 11.0 onward have the bug fixed. The affected vendor is facelessuser, with product pymdown-extensions. Users running version 10.21.3 or earlier on any platform that loads untrusted Markdown with the b64 extension enabled are exposed.

The CVSS score of 5.3 places the flaw in the medium severity range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying there are no confirmed large‑scale exploits yet. The attack requires that the attacker controls the Markdown input or the rendering environment to supply a malicious image source. The path traversal can only read files with image extensions (.png, .jpg, .jpeg, .gif, .svg) that are readable by the process, so the attack surface is limited to those files but still provides a mechanism for leaking sensitive data. The likely vector is an application that processes untrusted Markdown, such as a static site generator, documentation platform, or a CMS that uses pymdown-extensions for markdown rendering.