CVE-2026-41205
HighAdvisory
Published 16 Apr 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.004
- 29th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 107
- of 17,781 indexed, latest versions
- Container images
- 108
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Carried by container images the latest versions of 107 of 17,781 indexed charts deploy, on 108 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| makopypi | 0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+24 more | 1.3.11 | 108 |
| makodeb | 1.0.7+ds1-1, 1.2.4+ds-1, 1.3.2-1 | 1.0.7+ds1-1ubuntu0.2+esm1, 1.3.2-1ubuntu0.1 | 4 |
- OSV records
- DEBIAN-CVE-2026-41205GHSA-v92g-xgxw-vvmmUBUNTU-CVE-2026-41205
- Also known as
- PYSEC-2026-88, USN-8234-1
Charts affected
107 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| studygovernorstudy-governorVerified publisher | 0.1.38 | 1 of 3See more | 1,447 |
| jupyterhubuninettsigma2 | 1.6.0 | 1 of 5See more | 8,607 |
| simple-prima-notavcnngrVerified publisher | 0.5.3 | 1 of 4See more | 4,768 |
| supersetwbstack | 0.1.0 | 1 of 1See more | 7,085 |
| ceph-csi-cephfswikimedia | 0.1.8 | 1 of 5See more | 10,285 |
| ceph-csi-rbdwikimedia | 0.1.13 | 1 of 6See more | 11,784 |
| powerdnsadminwitcom-gmbh | 0.3.4 | 1 of 1See more | 2,643 |
Container images carrying it
108 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 16b50bbef664 | mako | 1.3.11 | 3 |
| dpage/ | 781369df9994 | mako | 1.3.11 | 3 |
| amancevice/ | 12a0a9e66550 | mako | 1.3.11 | 2 |
| larribas/ | 05ccb0b46bfb | mako | 1.3.11 | 2 |
| ngoduykhanh/ | ba36ab196d3d | mako | 1.3.11 | 2 |
| opendatacube/ | 668cbb41473c | mako | 1.3.11 | 2 |
| quay.io/ | f7f8228f17cc | mako | 1.3.11 | 2 |
| amancevice/ | c8c04bfe3d66 | mako | 1.3.11 | 1 |
| apache/ | 64e58748b6b9 | mako | 1.3.11 | 1 |
| apache/ | ce90bdc3d2af | mako | 1.3.11 | 1 |
| apache/ | e5560ad0b86e | mako | 1.3.11 | 1 |
| apache/ | 975ab033580d | mako | 1.3.11 | 1 |
| apache/ | ab9467fd712c | mako | 1.3.11 | 1 |
| apecloud/ | 8ac9947a2c84 | mako | 1.3.11 | 1 |
| archish27/ | 6610071a2101 | mako | 1.3.11 | 1 |
| aristidetm/ | 469dbc951224 | mako | 1.3.11 | 1 |
| aristidetm/ | ccb516cb8474 | mako | 1.3.11 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | mako | 1.3.11 | 1 |
| buntha/ | 154542cc3083 | mako | 1.3.11 | 1 |
| ceph/ | 90f30824a96e | mako | 1.3.11 | 1 |
| chorss/ | 5c549cacb8ab | mako | 1.3.11 | 1 |
| cleveritcz/ | c75c1636e0b7 | mako | 1.3.11 | 1 |
| dalibo/ | 2a0b749c2f7f | mako | 1.3.11 | 1 |
| daskdev/ | 052630f5ca04 | mako | 1.3.11 | 1 |
| devopstales/ | 8bb837da5aec | mako | 1.3.11 | 1 |
| dpage/ | 18cd5711fc9a | mako | 1.3.11 | 1 |
| dpage/ | 37946e4f3e7b | mako | 1.3.11 | 1 |
| dpage/ | 50700ac17936 | mako | 1.3.11 | 1 |
| dpage/ | 52cb72a9e3da | mako | 1.3.11 | 1 |
| dpage/ | 561c1f8f99f2 | mako | 1.3.11 | 1 |
| dpage/ | a5a656e1d5fd | mako | 1.3.11 | 1 |
| dpage/ | b1f00b8163cf | mako | 1.3.11 | 1 |
| elastichq/ | bb3bd22c2b87 | mako | 1.3.11 | 1 |
| evk02/ | ef6ff257ef35 | mako | 1.3.11 | 1 |
| freedom98/ | d7ce1533f297 | mako | 1.3.11 | 1 |
| galaxy/ | 0267bad550e6 | mako | 1.3.11 | 1 |
| gethue/ | 11b649636e68 | mako | 1.3.11 | 1 |
| gethue/ | 5702b2c37ff9 | mako | 1.3.11 | 1 |
| gethue/ | 7d5c1b9f8a79 | mako | 1.3.11 | 1 |
| gpappsoft/ | af7841adad26 | mako | 1.3.11 | 1 |
| hkotel/ | a7e6b6abe087 | mako | 1.3.11 | 1 |
| ihatemoney/ | 457fda1feb32 | mako | 1.3.11 | 1 |
| jaedb/ | 048cfbf58d57 | mako mako | no fix listed 1.3.11 | 1 |
| jakuboskera/ | 4989afa06e74 | mako | 1.3.11 | 1 |
| jakuboskera/ | 714b1adbbc2d | mako | 1.3.11 | 1 |
| john19968010/ | 31a90f6bd69c | mako | 1.3.11 | 1 |
| jupyterhub/ | 5a0ceed1300a | mako | 1.3.11 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | mako | 1.3.11 | 1 |
| jupyterhub/ | e4770285aaf7 | mako | 1.3.11 | 1 |
| jupyterhub/ | 8e4778efec8e | mako | 1.3.11 | 1 |