StackRadar

CVE-2026-102991

Medium

Advisory

Published 2 Oct 2026In the index since 3 Oct 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
169
of 18,026 indexed, latest versions
Container images
169
deployed by those charts
Fix available
1 of 2
affected packages

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Carried by container images the latest versions of 169 of 18,026 indexed charts deploy, on 169 images.

Affected packageAffected versionsFixed inImages
makopypi0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+28 more1.4.2169
makodeb1.0.7+ds1-1, 1.1.0+ds1-1ubuntu2.1, 1.3.2-1no fix listed4
OSV records
GHSA-5639-2j2p-m4mxUBUNTU-CVE-2026-102991

Charts affected

169 by stars
ChartLatestAffected imagesRadar Score
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
mako@1.3.12
1.4.2

Open the chart page →

3,684
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
mako@1.3.0
1.4.2

Open the chart page →

11,442
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
mako@1.3.6
1.4.2

Open the chart page →

1,911
pev2schichtelVerified publisher0.3.01 of 1See more

pev2 schichtel 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dalibo/explain.dalibo.com:2.20.12a0b749c2f7f
mako@1.3.10
1.4.2

Open the chart page →

1,255
pgadminsikalabs0.1.01 of 2See more

pgadmin sikalabs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
mako@1.4.1
1.4.2

Open the chart page →

93
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
mako@1.2.4
1.4.2

Open the chart page →

6,485
spoolmanspoolmanVerified publisher0.2.71 of 1See more

spoolman spoolman 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/donkie/spoolman:0.27.07aba565eff77
mako@1.3.12
1.4.2

Open the chart page →

2,433
srsran-5gsrsran-5gVerified publisher1.0.01 of 1See more

srsran-5g srsran-5g 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
gradiant/srsran-5g:23_10_19061b1bf0f36
mako@1.1.0+ds1-1ubuntu2.1
mako@1.1.0
no fix listed
1.4.2

Open the chart page →

70,122
srsran-5g-zmqsrsran-5g-zmqVerified publisher1.0.11 of 2See more

srsran-5g-zmq srsran-5g-zmq 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
gradiant/srsran-5g:23_10_19061b1bf0f36
mako@1.1.0+ds1-1ubuntu2.1
mako@1.1.0
no fix listed
1.4.2

Open the chart page →

75,836
servicexssl-hep1.8.61 of 16See more

servicex ssl-hep 1.8.6

1 of the 16 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.6c935e123030d
mako@1.3.12
1.4.2

Open the chart page →

61,380
pgadminstakaterVerified publisher0.1.141 of 1See more

pgadmin stakater 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:4.5a5a656e1d5fd
mako@1.0.8
1.4.2

Open the chart page →

2,129
studygovernorstudy-governorVerified publisher0.1.381 of 3See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
mako@1.3.0
1.4.2

Open the chart page →

1,971
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
mako@1.2.2
1.4.2

Open the chart page →

9,728
uptime-platformuptime-platformVerified publisher0.1.31 of 3See more

uptime-platform uptime-platform 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
sashastudent/uptime-platform:latest37a82b4e598e
mako@1.4.1
1.4.2

Open the chart page →

923
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
mako@1.3.9
1.4.2

Open the chart page →

5,829
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
mako@1.2.4
1.4.2

Open the chart page →

7,625
ceph-csi-cephfswikimedia0.2.01 of 5See more

ceph-csi-cephfs wikimedia 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
mako@1.1.4.dev0
1.4.2

Open the chart page →

5,888
ceph-csi-rbdwikimedia0.2.01 of 6See more

ceph-csi-rbd wikimedia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
mako@1.1.4.dev0
1.4.2

Open the chart page →

6,784
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
mako@1.1.5
1.4.2

Open the chart page →

2,726

Container images carrying it

169 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
mako@1.1.4
1.4.2
1
pangeo/base-notebook:2024.01.155fbe688a4f80
mako@1.3.0
1.4.2
1
photoprism/photoprism:240711-cefc6fd632ca74
mako@1.3.2-1
mako@1.3.2.dev0
no fix listed
1.4.2
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
mako@1.3.5
1.4.2
1
prefecthq/prometheus-prefect-exporter:4.1.06e0e79cabdc2
mako@1.4.1
1.4.2
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
mako@1.3.12
1.4.2
1
redash/redash:25.8.000d813437db5
mako@1.3.9
1.4.2
1
redash/redash:10.0.0.b503639392753c0376
mako@1.1.5
1.4.2
1
redash/redash:26.3.0c5c9148f5c38
mako@1.3.9
1.4.2
1
rommapp/romm:5.2.03512f2ca4557
mako@1.3.12
1.4.2
1
rommapp/romm:4.4.1b909e95d1aab
mako@1.3.10
1.4.2
1
salehmir/jesse:1.10.101afa95f979e9
mako@1.3.10
1.4.2
1
sashastudent/uptime-platform:latest37a82b4e598e
mako@1.4.1
1.4.2
1
sslhep/servicex_app:v1.8.6c935e123030d
mako@1.3.12
1.4.2
1
statcan/ckan:2.93921305425b8
mako@1.1.0
1.4.2
1
szurubooru/server:2.5accf2ad9fbc3
mako@1.3.12
1.4.2
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
mako@1.2.4
1.4.2
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
mako@1.2.4
1.4.2
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
mako@1.3.12
1.4.2
1
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
mako@1.3.12
1.4.2
1
youssef11gaber10/flask-service:latest9c727fcfde76
mako@1.3.12
1.4.2
1
zenmldocker/kitaru-server:0.27.1f1c4675a188b
mako@1.3.12
1.4.2
1
zurdi15/romm:2.3.12db88fe44c89
mako@1.2.4
1.4.2
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
mako@1.3.3
1.4.2
1
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
mako@1.4.1
1.4.2
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
mako@1.3.8
1.4.2
1
ghcr.io/crazy-max/firefox-syncserver:1.8.0ab1a959d8105
mako@1.1.3
1.4.2
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
mako@1.3.10
1.4.2
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
mako@1.3.10
1.4.2
1
ghcr.io/donkie/spoolman:0.24.042135965c42d
mako@1.3.12
1.4.2
1
ghcr.io/donkie/spoolman:0.26.1cf9b41e17b93
mako@1.3.12
1.4.2
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
mako@1.3.12
1.4.2
1
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
mako@1.3.10
1.4.2
1
ghcr.io/guydavis/machinaris:test50a71a30f18e
mako@1.4.1
1.4.2
1
ghcr.io/home-operations/bazarr:1.6.217dc1cff22e9
mako@1.3.12
1.4.2
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
mako@1.3.8
1.4.2
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
mako@1.3.10
1.4.2
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
mako@1.3.10
1.4.2
1
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
mako@1.3.12
1.4.2
1
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
mako@1.1.4
1.4.2
1
ghcr.io/linuxserver/sickchill:2021.5.10-1-ls63a607452a692a
mako@1.1.4
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
mako@1.2.4
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
mako@1.4.1
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.28.08b02290f4d18
mako@1.4.1
1.4.2
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
mako@1.2.4
1.4.2
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
mako@1.3.10
1.4.2
1
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
mako@1.2.4
1.4.2
1
ghcr.io/nicholaswilde/odoo:version-14.07cff9672ce07
mako@1.0.7
1.4.2
1
ghcr.io/observal/observal-api:1.14.05a20125eafd4
mako@1.3.12
1.4.2
1
ghcr.io/opendatacube/explorer:latest7c25578068cd
mako@1.3.12
1.4.2
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.