CVE-2026-46338mediumCWE-22

CVE-2026-46338: falha de média gravidade em facelessuser pymdown-extensions

PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pymdown-extensions+ Monitorar pymdown-extensions

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
facelessuser · pymdown-extensions
CVEs relacionadas — facelessuser pymdown-extensions

No mesmo produto, das mais perigosas para as menos.

CVE-2023-32309HIGHArbitrary file inclusion with the pymdowm-snippets extensionEPSS 1.7%CVE-2026-67422HIGHpymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsEPSS 0.7%CVE-2025-68142LOWPyMdown Extensions has ReDOS bug in Figure Capture extensionEPSS 0.5%CVE-2026-61632MEDIUMPyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_pathEPSS 0.4%