StackRadarChart IndexLive demo

CVE-2026-41205

High

Advisory

Published 16 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 29th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 107; of 17,781 indexed, latest versions
Container images: 108; deployed by those charts
Fix available: 2 of 2; affected packages

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Carried by container images the latest versions of 107 of 17,781 indexed charts deploy, on 108 images.

Affected package	Affected versions	Fixed in	Images
makopypi	0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+24 more	1.3.11	108
makodeb	1.0.7+ds1-1, 1.2.4+ds-1, 1.3.2-1	1.0.7+ds1-1ubuntu0.2+esm1, 1.3.2-1ubuntu0.1	4

OSV records: DEBIAN-CVE-2026-41205 GHSA-v92g-xgxw-vvmm UBUNTU-CVE-2026-41205
Also known as: PYSEC-2026-88, USN-8234-1

Charts affected

107 by stars

Chart

Latest

Affected images

Radar Score

studygovernorstudy-governor

1 of 3 See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2026-41205.

Container image	Digest	Package	Fixed in
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	mako@1.3.0	1.3.11

Open the chart page →

1,447

jupyterhubuninettsigma2

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-41205.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	mako@1.2.2	1.3.11

Open the chart page →

8,607

simple-prima-notavcnngr

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-41205.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	mako@1.3.9	1.3.11

Open the chart page →

4,768

supersetwbstack

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	mako@1.2.4	1.3.11

Open the chart page →

7,085

ceph-csi-cephfswikimedia

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-41205.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	mako@1.0.6.dev0	1.3.11

Open the chart page →

10,285

ceph-csi-rbdwikimedia

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-41205.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	mako@1.0.6.dev0	1.3.11

Open the chart page →

11,784

powerdnsadminwitcom-gmbh

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-41205.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	mako@1.1.5	1.3.11

Open the chart page →

2,643

Container images carrying it

108 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/mlops-for-all/mlflow-tracking-server :3.8-1.30.1-v1.0.0	d30e631684c3	mako@1.2.4	1.3.11	1
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	mako@1.3.10	1.3.11	1
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	mako@1.3.2	1.3.11	1
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	mako@1.3.0	1.3.11	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	mako@1.2.2	1.3.11	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	mako@1.1.5	1.3.11	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	mako@1.1.5	1.3.11	1
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	mako@1.3.0	1.3.11	1