StackRadar

CVE-2026-41205

High

Advisory

Published 16 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
107
of 17,781 indexed, latest versions
Container images
108
deployed by those charts
Fix available
2 of 2
affected packages

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Carried by container images the latest versions of 107 of 17,781 indexed charts deploy, on 108 images.

Affected packageAffected versionsFixed inImages
makopypi0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+24 more1.3.11108
makodeb1.0.7+ds1-1, 1.2.4+ds-1, 1.3.2-11.0.7+ds1-1ubuntu0.2+esm1, 1.3.2-1ubuntu0.14
OSV records
DEBIAN-CVE-2026-41205GHSA-v92g-xgxw-vvmmUBUNTU-CVE-2026-41205
Also known as
PYSEC-2026-88, USN-8234-1

Charts affected

107 by stars
ChartLatestAffected imagesRadar Score
studygovernorstudy-governorVerified publisher0.1.381 of 3See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
mako@1.3.0
1.3.11

Open the chart page →

1,447
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
mako@1.2.2
1.3.11

Open the chart page →

8,607
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
mako@1.3.9
1.3.11

Open the chart page →

4,768
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
mako@1.2.4
1.3.11

Open the chart page →

7,085
ceph-csi-cephfswikimedia0.1.81 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
mako@1.0.6.dev0
1.3.11

Open the chart page →

10,285
ceph-csi-rbdwikimedia0.1.131 of 6See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
mako@1.0.6.dev0
1.3.11

Open the chart page →

11,784
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
mako@1.1.5
1.3.11

Open the chart page →

2,643

Container images carrying it

108 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
mako@1.1.3
1.3.11
1
kelvinsp/mlflow:1.26.1cd33e6db2a59
mako@1.2.0
1.3.11
1
langgenius/dify-api:1.0.0066035f93856
mako@1.3.9
1.3.11
1
langgenius/dify-api:0.6.11fca918260dd6
mako@1.3.5
1.3.11
1
lib42/deluge:20c4d1d326f95
mako@1.2.4
1.3.11
1
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
mako@1.3.10
1.3.11
1
linuxserver/deluge:18.04.10ac871624394
mako@1.0.7+ds1-1
mako@1.0.7
1.0.7+ds1-1ubuntu0.2+esm1
1.3.11
1
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
mako@1.0.7+ds1-1
mako@1.0.7
1.0.7+ds1-1ubuntu0.2+esm1
1.3.11
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
mako@1.1.3
1.3.11
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
mako@1.1.6
1.3.11
1
lsstsqre/prepuller:latest19c2dfc4e4ff
mako@1.1.4
1.3.11
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
mako@0.8.1
1.3.11
1
lsstsqre/wfdispatcher:lateste9feb99f524d
mako@1.1.4
1.3.11
1
makersquad/harp-proxy:0.8.1a40dd258c527
mako@1.3.10
1.3.11
1
miltex/python-api:1.0.0dab12a7748d5
mako@1.1.4
1.3.11
1
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
mako@1.2.4
1.3.11
1
mozilla/syncserver:latest016162bf39d8
mako@1.0.9
1.3.11
1
ngoduykhanh/powerdns-admin:0.2.3099371dd9ba6
mako@1.1.3
1.3.11
1
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
mako@1.2.4
1.3.11
1
oled01/automx2:2025.1.105d3e398e675
mako@1.3.10
1.3.11
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
mako@1.3.10
1.3.11
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
mako@1.3.10
1.3.11
1
opendatacube/explorer:latest120457ffcd69
mako@1.3.10
1.3.11
1
opendatacube/wps:latest80df355a660b
mako@1.3.9
1.3.11
1
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
mako@1.1.4
1.3.11
1
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
mako@1.1.4
1.3.11
1
pangeo/base-notebook:2024.01.155fbe688a4f80
mako@1.3.0
1.3.11
1
photoprism/photoprism:240711-cefc6fd632ca74
mako@1.3.2-1
mako@1.3.2.dev0
1.3.2-1ubuntu0.1
1.3.11
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
mako@1.3.5
1.3.11
1
redash/redash:25.8.000d813437db5
mako@1.3.9
1.3.11
1
redash/redash:10.0.0.b503639392753c0376
mako@1.1.5
1.3.11
1
redash/redash:26.3.0c5c9148f5c38
mako@1.3.9
1.3.11
1
rommapp/romm:4.4.1b909e95d1aab
mako@1.3.10
1.3.11
1
salehmir/jesse:1.10.101afa95f979e9
mako@1.3.10
1.3.11
1
statcan/ckan:2.93921305425b8
mako@1.1.0
1.3.11
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
mako@1.2.4
1.3.11
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
mako@1.2.4
1.3.11
1
zurdi15/romm:2.3.12db88fe44c89
mako@1.2.4
1.3.11
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
mako@1.3.3
1.3.11
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
mako@1.3.8
1.3.11
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
mako@1.3.10
1.3.11
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
mako@1.3.10
1.3.11
1
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
mako@1.3.10
1.3.11
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
mako@1.3.8
1.3.11
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
mako@1.3.10
1.3.11
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
mako@1.3.10
1.3.11
1
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
mako@1.1.4
1.3.11
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
mako@1.2.4
1.3.11
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
mako@1.2.4
1.3.11
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
mako@1.3.10
1.3.11
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.