CVE-2026-46338: medium-severity vulnerability in facelessuser pymdown-extensions
PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.4%
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
facelessuser · pymdown-extensionsRelated CVEs — facelessuser pymdown-extensions
In the same product, most dangerous first.
CVE-2023-32309HIGHArbitrary file inclusion with the pymdowm-snippets extensionEPSS 1.7%CVE-2026-67422HIGHpymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsEPSS 0.7%CVE-2025-68142LOWPyMdown Extensions has ReDOS bug in Figure Capture extensionEPSS 0.5%CVE-2026-61632MEDIUMPyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_pathEPSS 0.4%