StackRadar

CVE-2026-102991

Medium

Advisory

Published 2 Oct 2026In the index since 3 Oct 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
169
of 18,026 indexed, latest versions
Container images
169
deployed by those charts
Fix available
1 of 2
affected packages

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Carried by container images the latest versions of 169 of 18,026 indexed charts deploy, on 169 images.

Affected packageAffected versionsFixed inImages
makopypi0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+28 more1.4.2169
makodeb1.0.7+ds1-1, 1.1.0+ds1-1ubuntu2.1, 1.3.2-1no fix listed4
OSV records
GHSA-5639-2j2p-m4mxUBUNTU-CVE-2026-102991

Charts affected

169 by stars
ChartLatestAffected imagesRadar Score
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
mako@1.1.0
1.4.2

Open the chart page →

105,042
radosgwananace-chartsVerified publisher0.3.41 of 1See more

radosgw ananace-charts 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ceph/daemon:latest-nautilus90f30824a96e
mako@0.8.1
1.4.2

Open the chart page →

1,783
pgadminappscodeVerified publisher2026.3.301 of 1See more

pgadmin appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.11.050700ac17936
mako@1.3.10
1.4.2

Open the chart page →

1,776
pgadminarunalakmalVerified publisher0.1.01 of 1See more

pgadmin arunalakmal 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
mako@1.2.1
1.4.2

Open the chart page →

2,596
swdpgadminarunalakmalVerified publisher0.1.01 of 1See more

swdpgadmin arunalakmal 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
mako@1.2.1
1.4.2

Open the chart page →

2,596
keystonearzu0.2.292 of 4See more

keystone arzu 0.2.29

2 of the 4 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
mako@1.1.4
1.4.2
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
mako@1.1.4
1.4.2

Open the chart page →

24,529
locationprocessingassist-iot-location-processing1.0.01 of 3See more

locationprocessing assist-iot-location-processing 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
mako@1.2.1
1.4.2

Open the chart page →

11,665
mealiebdclark-helm-chartsVerified publisher0.1.151 of 1See more

mealie bdclark-helm-charts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
mako@1.4.1
1.4.2

Open the chart page →

5,083
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
mako@1.1.4
1.4.2

Open the chart page →

88,028
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
mako@1.1.3
1.4.2

Open the chart page →

2,715
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
mako@1.3.8
1.4.2

Open the chart page →

17,923
kitchenowlchart-kitchenowl0.1.131 of 2See more

kitchenowl chart-kitchenowl 0.1.13

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
mako@1.3.12
1.4.2

Open the chart page →

3,131
syncserverchristianhuthVerified publisher1.3.01 of 1See more

syncserver christianhuth 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
mozilla/syncserver:latest016162bf39d8
mako@1.0.9
1.4.2

Open the chart page →

1,500
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
mako@1.0.7
1.4.2

Open the chart page →

31,543
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
mako@1.0.7
1.4.2

Open the chart page →

6,569
galaxycloudve6.8.81 of 3See more

galaxy cloudve 6.8.8

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
mako@1.3.12
1.4.2

Open the chart page →

7,039
galaxy-stablecloudve2.0.01 of 5See more

galaxy-stable cloudve 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
mako@1.0.2
1.4.2

Open the chart page →

169,853
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
mako@1.3.12
1.4.2

Open the chart page →

14,892
csghubcsghubVerified publisher2.5.02 of 34See more

csghub csghub 2.5.0

2 of the 34 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
mako@1.3.10
1.4.2
opencsghq/csgbot:v0.6.9-ee7d0271e26521
mako@1.3.10
1.4.2

Open the chart page →

58,956
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
mako@1.3.5
1.4.2
aristidetm/k8s-hub:3.3.7ccb516cb8474
mako@1.3.2
1.4.2

Open the chart page →

19,384
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
mako@1.3.9
1.4.2

Open the chart page →

5,767
datacube-indexdatacube-charts0.4.41 of 2See more

datacube-index datacube-charts 0.4.4

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
opendatacube/ows:latest668cbb41473c
mako@1.3.8
1.4.2

Open the chart page →

6,834
datacube-owsdatacube-charts0.20.31 of 1See more

datacube-ows datacube-charts 0.20.3

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/opendatacube/ows:latestf591c9d96c0f
mako@1.3.12
1.4.2

Open the chart page →

3,385
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
mako@1.3.9
1.4.2

Open the chart page →

6,842
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latest8c2d48c1545c
mako@1.3.12
1.4.2

Open the chart page →

2,720
mlflowdeliveryheroVerified publisher1.0.101 of 1See more

mlflow deliveryhero 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
mako@1.1.3
1.4.2

Open the chart page →

5,087
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
mako@1.3.10
1.4.2

Open the chart page →

2,695
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
mako@1.3.9
1.4.2

Open the chart page →

56,689
photoprismdjjudas21Verified publisher99.99.991 of 1See more

photoprism djjudas21 99.99.99

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
photoprism/photoprism:240711-cefc6fd632ca74
mako@1.3.2-1
mako@1.3.2.dev0
no fix listed
1.4.2

Open the chart page →

98,943
spoolmandjjudas21Verified publisher0.1.81 of 1See more

spoolman djjudas21 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/donkie/spoolman:0.24.042135965c42d
mako@1.3.12
1.4.2

Open the chart page →

2,525
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
mako@1.3.10
1.4.2

Open the chart page →

11,744
pgadmin4eks-storageclass0.1.01 of 2See more

pgadmin4 eks-storageclass 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
mako@1.4.1
1.4.2

Open the chart page →

93
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
mako@1.3.10
1.4.2

Open the chart page →

3,103
infrafibonacci-cluster-infraVerified publisher1.0.01 of 4See more

infra fibonacci-cluster-infra 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.418cd5711fc9a
mako@1.3.2
1.4.2

Open the chart page →

14,865
forms-catalogueforms-catalogue0.1.01 of 2See more

forms-catalogue forms-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
mako@1.1.5
1.4.2

Open the chart page →

2,845
powerdnsfsdrw080.1.31 of 4See more

powerdns fsdrw08 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
mako@1.2.4
1.4.2

Open the chart page →

2,432
delugegeek-cookbookVerified publisher5.4.21 of 1See more

deluge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
mako@1.0.7+ds1-1
mako@1.0.7
no fix listed
1.4.2

Open the chart page →

14,105
ihatemoneygeek-cookbookVerified publisher1.1.21 of 1See more

ihatemoney geek-cookbook 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ihatemoney/ihatemoney:5.2.0457fda1feb32
mako@1.2.0
1.4.2

Open the chart page →

1,579
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
mako@1.2.4.dev0
1.4.2

Open the chart page →

14,391
mylargeek-cookbookVerified publisher4.4.21 of 1See more

mylar geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
mako@1.1.4
1.4.2

Open the chart page →

1,485
powerdns-admingeek-cookbookVerified publisher1.2.21 of 1See more

powerdns-admin geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
mako@1.1.5
1.4.2

Open the chart page →

2,726
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
mako@1.3.10
1.4.2

Open the chart page →

10,718
geomapfishgeomapfish0.8.01 of 3See more

geomapfish geomapfish 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
camptocamp/geomapfishapp-geoportal:latestae874f70cc16
mako@1.3.12
1.4.2

Open the chart page →

7,313
pgadminhalkeye1.0.01 of 1See more

pgadmin halkeye 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
chorss/docker-pgadmin4:4.115c549cacb8ab
mako@1.1.0
1.4.2

Open the chart page →

2,632
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
mako@1.3.12
1.4.2

Open the chart page →

6,286
mlflowhelm-charts-nr1.0.101 of 1See more

mlflow helm-charts-nr 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
mako@1.1.3
1.4.2

Open the chart page →

5,087
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
mako@1.3.10
1.4.2

Open the chart page →

2,695
ckanhelmforgeVerified publisher1.3.91 of 6See more

ckan helmforge 1.3.9

1 of the 6 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ckan/ckan-base:2.12.087ecf3f27ad6
mako@1.3.12
1.4.2

Open the chart page →

11,398
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
mako@1.3.12
1.4.2

Open the chart page →

6,062
langflowhelmforgeVerified publisher2.0.21 of 1See more

langflow helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.334055a07d446
mako@1.3.12
1.4.2

Open the chart page →

492

Container images carrying it

169 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
mako@1.1.4
1.4.2
1
pangeo/base-notebook:2024.01.155fbe688a4f80
mako@1.3.0
1.4.2
1
photoprism/photoprism:240711-cefc6fd632ca74
mako@1.3.2-1
mako@1.3.2.dev0
no fix listed
1.4.2
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
mako@1.3.5
1.4.2
1
prefecthq/prometheus-prefect-exporter:4.1.06e0e79cabdc2
mako@1.4.1
1.4.2
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
mako@1.3.12
1.4.2
1
redash/redash:25.8.000d813437db5
mako@1.3.9
1.4.2
1
redash/redash:10.0.0.b503639392753c0376
mako@1.1.5
1.4.2
1
redash/redash:26.3.0c5c9148f5c38
mako@1.3.9
1.4.2
1
rommapp/romm:5.2.03512f2ca4557
mako@1.3.12
1.4.2
1
rommapp/romm:4.4.1b909e95d1aab
mako@1.3.10
1.4.2
1
salehmir/jesse:1.10.101afa95f979e9
mako@1.3.10
1.4.2
1
sashastudent/uptime-platform:latest37a82b4e598e
mako@1.4.1
1.4.2
1
sslhep/servicex_app:v1.8.6c935e123030d
mako@1.3.12
1.4.2
1
statcan/ckan:2.93921305425b8
mako@1.1.0
1.4.2
1
szurubooru/server:2.5accf2ad9fbc3
mako@1.3.12
1.4.2
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
mako@1.2.4
1.4.2
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
mako@1.2.4
1.4.2
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
mako@1.3.12
1.4.2
1
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
mako@1.3.12
1.4.2
1
youssef11gaber10/flask-service:latest9c727fcfde76
mako@1.3.12
1.4.2
1
zenmldocker/kitaru-server:0.27.1f1c4675a188b
mako@1.3.12
1.4.2
1
zurdi15/romm:2.3.12db88fe44c89
mako@1.2.4
1.4.2
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
mako@1.3.3
1.4.2
1
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
mako@1.4.1
1.4.2
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
mako@1.3.8
1.4.2
1
ghcr.io/crazy-max/firefox-syncserver:1.8.0ab1a959d8105
mako@1.1.3
1.4.2
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
mako@1.3.10
1.4.2
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
mako@1.3.10
1.4.2
1
ghcr.io/donkie/spoolman:0.24.042135965c42d
mako@1.3.12
1.4.2
1
ghcr.io/donkie/spoolman:0.26.1cf9b41e17b93
mako@1.3.12
1.4.2
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
mako@1.3.12
1.4.2
1
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
mako@1.3.10
1.4.2
1
ghcr.io/guydavis/machinaris:test50a71a30f18e
mako@1.4.1
1.4.2
1
ghcr.io/home-operations/bazarr:1.6.217dc1cff22e9
mako@1.3.12
1.4.2
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
mako@1.3.8
1.4.2
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
mako@1.3.10
1.4.2
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
mako@1.3.10
1.4.2
1
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
mako@1.3.12
1.4.2
1
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
mako@1.1.4
1.4.2
1
ghcr.io/linuxserver/sickchill:2021.5.10-1-ls63a607452a692a
mako@1.1.4
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
mako@1.2.4
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
mako@1.4.1
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.28.08b02290f4d18
mako@1.4.1
1.4.2
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
mako@1.2.4
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
mako@1.3.10
1.4.2
1
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
mako@1.2.4
1.4.2
1
ghcr.io/nicholaswilde/odoo:version-14.07cff9672ce07
mako@1.0.7
1.4.2
1
ghcr.io/observal/observal-api:1.14.05a20125eafd4
mako@1.3.12
1.4.2
1
ghcr.io/opendatacube/explorer:latest7c25578068cd
mako@1.3.12
1.4.2
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.