StackRadar

CVE-2026-41205

High

Advisory

Published 16 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
107
of 17,781 indexed, latest versions
Container images
108
deployed by those charts
Fix available
2 of 2
affected packages

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Carried by container images the latest versions of 107 of 17,781 indexed charts deploy, on 108 images.

Affected packageAffected versionsFixed inImages
makopypi0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+24 more1.3.11108
makodeb1.0.7+ds1-1, 1.2.4+ds-1, 1.3.2-11.0.7+ds1-1ubuntu0.2+esm1, 1.3.2-1ubuntu0.14
OSV records
DEBIAN-CVE-2026-41205GHSA-v92g-xgxw-vvmmUBUNTU-CVE-2026-41205
Also known as
PYSEC-2026-88, USN-8234-1

Charts affected

107 by stars
ChartLatestAffected imagesRadar Score
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
mako@1.3.9
1.3.11

Open the chart page →

19,224
photoprismdjjudas21Verified publisher99.99.991 of 1See more

photoprism djjudas21 99.99.99

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
photoprism/photoprism:240711-cefc6fd632ca74
mako@1.3.2-1
mako@1.3.2.dev0
1.3.2-1ubuntu0.1
1.3.11

Open the chart page →

16,954
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
mako@1.3.10
1.3.11

Open the chart page →

10,270
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
mako@1.3.10
1.3.11

Open the chart page →

2,896
infrafibonacci-cluster-infraVerified publisher1.0.01 of 4See more

infra fibonacci-cluster-infra 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.418cd5711fc9a
mako@1.3.2
1.3.11

Open the chart page →

12,454
forms-catalogueforms-catalogue0.1.01 of 2See more

forms-catalogue forms-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
mako@1.1.5
1.3.11

Open the chart page →

2,188
powerdnsfsdrw080.1.31 of 4See more

powerdns fsdrw08 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
mako@1.2.4
1.3.11

Open the chart page →

1,958
delugegeek-cookbookVerified publisher5.4.21 of 1See more

deluge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
mako@1.0.7+ds1-1
mako@1.0.7
1.0.7+ds1-1ubuntu0.2+esm1
1.3.11

Open the chart page →

13,551
ihatemoneygeek-cookbookVerified publisher1.1.21 of 1See more

ihatemoney geek-cookbook 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ihatemoney/ihatemoney:5.2.0457fda1feb32
mako@1.2.0
1.3.11

Open the chart page →

1,526
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
mako@1.2.4+ds-1
mako@1.2.4.dev0
no fix listed
1.3.11

Open the chart page →

12,958
mylargeek-cookbookVerified publisher4.4.21 of 1See more

mylar geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
mako@1.1.4
1.3.11

Open the chart page →

1,423
powerdns-admingeek-cookbookVerified publisher1.2.21 of 1See more

powerdns-admin geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
mako@1.1.5
1.3.11

Open the chart page →

2,643
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
mako@1.3.10
1.3.11

Open the chart page →

8,923
pgadminhalkeye1.0.01 of 1See more

pgadmin halkeye 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
chorss/docker-pgadmin4:4.115c549cacb8ab
mako@1.1.0
1.3.11

Open the chart page →

2,555
mlflowhelm-charts-nr1.0.101 of 1See more

mlflow helm-charts-nr 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
mako@1.1.3
1.3.11

Open the chart page →

4,422
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
mako@1.3.10
1.3.11

Open the chart page →

2,305
supersethelmforgeVerified publisher1.3.61 of 5See more

superset helmforge 1.3.6

1 of the 5 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
mako@1.3.10
1.3.11

Open the chart page →

5,714
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:1.2.0e4770285aaf7
mako@1.1.4
1.3.11

Open the chart page →

37,671
redashinseefrlab2.1.01 of 3See more

redash inseefrlab 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
redash/redash:10.0.0.b503639392753c0376
mako@1.1.5
1.3.11

Open the chart page →

3,314
guestbookjakuboskera0.2.01 of 3See more

guestbook jakuboskera 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
jakuboskera/guestbook:v0.3.04989afa06e74
mako@1.1.6
1.3.11

Open the chart page →

1,090
todojakuboskera0.1.11 of 1See more

todo jakuboskera 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
jakuboskera/todo:v0.2.3714b1adbbc2d
mako@1.3.10
1.3.11

Open the chart page →

801
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
mako@1.3.8
1.3.11

Open the chart page →

1,794
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
mako@1.3.10
1.3.11

Open the chart page →

2,733
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
mako@1.2.3
1.3.11

Open the chart page →

16,417
mlflowkelvins0.4.01 of 3See more

mlflow kelvins 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
kelvinsp/mlflow:1.26.1cd33e6db2a59
mako@1.2.0
1.3.11

Open the chart page →

4,156
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
mako@1.3.10
1.3.11

Open the chart page →

8,405
jupyterhubkubeblocksVerified publisher0.1.02 of 7See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
mako@1.2.4
1.3.11
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
mako@1.2.4
1.3.11

Open the chart page →

7,356
delugelib42Verified publisher1.3.01 of 1See more

deluge lib42 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
lib42/deluge:20c4d1d326f95
mako@1.2.4
1.3.11

Open the chart page →

898
delugelinkding0.2.31 of 1See more

deluge linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
mako@1.3.10
1.3.11

Open the chart page →

1,433
nubladolsst-sqre0.9.233 of 5See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
lsstsqre/prepuller:latest19c2dfc4e4ff
mako@1.1.4
1.3.11
lsstsqre/sciplat-hub:latest5e0ade6bed1c
mako@0.8.1
1.3.11
lsstsqre/wfdispatcher:lateste9feb99f524d
mako@1.1.4
1.3.11

Open the chart page →

5,786
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
mako@1.1.6
1.3.11

Open the chart page →

17,779
python-api-postgresmiltex0.0.11 of 2See more

python-api-postgres miltex 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
miltex/python-api:1.0.0dab12a7748d5
mako@1.1.4
1.3.11

Open the chart page →

2,347
mlflow-servermlflow-server0.3.01 of 1See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
mako@1.2.4
1.3.11

Open the chart page →

3,158
mlflowmondata-helm-chartsVerified publisher0.2.31 of 1See more

mlflow mondata-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
mako@1.2.4
1.3.11

Open the chart page →

3,811
my-fastapi-chartmy-fastapi-template0.1.01 of 1See more

my-fastapi-chart my-fastapi-template 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
john19968010/fastapi-template:latest31a90f6bd69c
mako@1.2.4
1.3.11

Open the chart page →

967
elasticsearch2ncsaVerified publisher0.2.21 of 2See more

elasticsearch2 ncsa 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
elastichq/elasticsearch-hq:latestbb3bd22c2b87
mako@1.1.0
1.3.11

Open the chart page →

4,911
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
mako@1.2.4
1.3.11

Open the chart page →

5,456
automx2oleds-helm-chartsVerified publisher1.0.51 of 1See more

automx2 oleds-helm-charts 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
oled01/automx2:2025.1.105d3e398e675
mako@1.3.10
1.3.11

Open the chart page →

5,288
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
mako@1.3.10
1.3.11

Open the chart page →

71,208
ctfdpascaliskeVerified publisher2.0.01 of 1See more

ctfd pascaliske 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
mako@1.3.10
1.3.11

Open the chart page →

2,376
prefect-agentprefectVerified publisher2024.8.301638221 of 1See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
mako@1.3.5
1.3.11

Open the chart page →

5,451
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
freedom98/flask:k3.0d7ce1533f297
mako@1.3.10
1.3.11

Open the chart page →

3,071
python-fastapi-postgrespython-fastapi-postgres0.1.01 of 1See more

python-fastapi-postgres python-fastapi-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
archish27/python-fastapi-postgres:latest6610071a2101
mako@1.2.1
1.3.11

Open the chart page →

2,983
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
mako@1.3.5
1.3.11

Open the chart page →

21,211
request-registryrequest-registry0.1.01 of 2See more

request-registry request-registry 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
mako@1.1.5
1.3.11

Open the chart page →

2,201
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
mako@1.3.0
1.3.11

Open the chart page →

10,209
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
mako@1.3.6
1.3.11

Open the chart page →

1,713
pev2schichtelVerified publisher0.3.01 of 1See more

pev2 schichtel 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
dalibo/explain.dalibo.com:2.20.12a0b749c2f7f
mako@1.3.10
1.3.11

Open the chart page →

1,178
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
mako@1.2.4
1.3.11

Open the chart page →

5,565
pgadminstakaterVerified publisher0.1.141 of 1See more

pgadmin stakater 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
dpage/pgadmin4:4.5a5a656e1d5fd
mako@1.0.8
1.3.11

Open the chart page →

2,060

Container images carrying it

108 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
mako@1.1.3
1.3.11
1
kelvinsp/mlflow:1.26.1cd33e6db2a59
mako@1.2.0
1.3.11
1
langgenius/dify-api:1.0.0066035f93856
mako@1.3.9
1.3.11
1
langgenius/dify-api:0.6.11fca918260dd6
mako@1.3.5
1.3.11
1
lib42/deluge:20c4d1d326f95
mako@1.2.4
1.3.11
1
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
mako@1.3.10
1.3.11
1
linuxserver/deluge:18.04.10ac871624394
mako@1.0.7+ds1-1
mako@1.0.7
1.0.7+ds1-1ubuntu0.2+esm1
1.3.11
1
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
mako@1.0.7+ds1-1
mako@1.0.7
1.0.7+ds1-1ubuntu0.2+esm1
1.3.11
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
mako@1.1.3
1.3.11
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
mako@1.1.6
1.3.11
1
lsstsqre/prepuller:latest19c2dfc4e4ff
mako@1.1.4
1.3.11
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
mako@0.8.1
1.3.11
1
lsstsqre/wfdispatcher:lateste9feb99f524d
mako@1.1.4
1.3.11
1
makersquad/harp-proxy:0.8.1a40dd258c527
mako@1.3.10
1.3.11
1
miltex/python-api:1.0.0dab12a7748d5
mako@1.1.4
1.3.11
1
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
mako@1.2.4
1.3.11
1
mozilla/syncserver:latest016162bf39d8
mako@1.0.9
1.3.11
1
ngoduykhanh/powerdns-admin:0.2.3099371dd9ba6
mako@1.1.3
1.3.11
1
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
mako@1.2.4
1.3.11
1
oled01/automx2:2025.1.105d3e398e675
mako@1.3.10
1.3.11
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
mako@1.3.10
1.3.11
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
mako@1.3.10
1.3.11
1
opendatacube/explorer:latest120457ffcd69
mako@1.3.10
1.3.11
1
opendatacube/wps:latest80df355a660b
mako@1.3.9
1.3.11
1
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
mako@1.1.4
1.3.11
1
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
mako@1.1.4
1.3.11
1
pangeo/base-notebook:2024.01.155fbe688a4f80
mako@1.3.0
1.3.11
1
photoprism/photoprism:240711-cefc6fd632ca74
mako@1.3.2-1
mako@1.3.2.dev0
1.3.2-1ubuntu0.1
1.3.11
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
mako@1.3.5
1.3.11
1
redash/redash:25.8.000d813437db5
mako@1.3.9
1.3.11
1
redash/redash:10.0.0.b503639392753c0376
mako@1.1.5
1.3.11
1
redash/redash:26.3.0c5c9148f5c38
mako@1.3.9
1.3.11
1
rommapp/romm:4.4.1b909e95d1aab
mako@1.3.10
1.3.11
1
salehmir/jesse:1.10.101afa95f979e9
mako@1.3.10
1.3.11
1
statcan/ckan:2.93921305425b8
mako@1.1.0
1.3.11
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
mako@1.2.4
1.3.11
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
mako@1.2.4
1.3.11
1
zurdi15/romm:2.3.12db88fe44c89
mako@1.2.4
1.3.11
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
mako@1.3.3
1.3.11
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
mako@1.3.8
1.3.11
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
mako@1.3.10
1.3.11
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
mako@1.3.10
1.3.11
1
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
mako@1.3.10
1.3.11
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
mako@1.3.8
1.3.11
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
mako@1.3.10
1.3.11
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
mako@1.3.10
1.3.11
1
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
mako@1.1.4
1.3.11
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
mako@1.2.4
1.3.11
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
mako@1.2.4
1.3.11
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
mako@1.3.10
1.3.11
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.