Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal
    (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-
    based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured
    template directory. This vulnerability is fixed in 1.3.12. (CVE-2026-44307)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal     (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-     based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured     template directory. This vulnerability is fixed in 1.3.12. (CVE-2026-44307)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458920	Echo: mako: security update to 1.3.10+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
458920	Echo: mako: security update to 1.3.10+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
314723	Linux Distros Unpatched Vulnerability : CVE-2026-44307	Nessus	Misc.	Local	high
441309	SCA: security update for Mako (GHSA-2h4p-vjrc-8xpq)	Tenable Cloud Security	SCA Checks	Local	high
441309	SCA: security update for Mako (GHSA-2h4p-vjrc-8xpq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-44307

high

Tenable Plugins

high

high

high

high

high