CVE-2026-46338mediumCWE-22

CVE-2026-46338: fallo de gravedad media en facelessuser pymdown-extensions

PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pymdown-extensions+ Monitorear pymdown-extensions

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.4%
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Productos afectados
facelessuser · pymdown-extensions
CVEs relacionadas — facelessuser pymdown-extensions

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-32309HIGHArbitrary file inclusion with the pymdowm-snippets extensionEPSS 1.7%CVE-2026-67422HIGHpymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsEPSS 0.7%CVE-2025-68142LOWPyMdown Extensions has ReDOS bug in Figure Capture extensionEPSS 0.5%CVE-2026-61632MEDIUMPyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_pathEPSS 0.4%