slash handling issue in template URI normalization #434

Activity

1. sqla-tester commented on Apr 14, 2026

   

   sqla-tester

   on Apr 14, 2026

   Collaborator

   More actions

   Mike Bayer has proposed a fix for this issue in the main branch:

   Fix path traversal via double-slash URI prefix in TemplateLookup https://gerrit.sqlalchemy.org/c/sqlalchemy/mako/+/6653
2. sqlalchemy-bot

   closed this as completedin e05ac61on Apr 14, 2026
3. pull

   added a commit that references this issue on Apr 14, 2026

   Fix path traversal via double-slash URI prefix in TemplateLookup

   ...

   This issue will close once commit e05ac61 is merged into the 'main' branch.

   e05ac61
4. zzzeek

   added

   bugSomething isn't workingSomething isn't working

   lookup

   on Apr 28, 2026
5. zzzeek commented on Apr 28, 2026

   

   zzzeek

   on Apr 28, 2026

   MemberAuthor

   More actions

   references: GHSA-v92g-xgxw-vvmm
6. sqlalchemy-bot

   added a commit that references this issue on Sep 22, 2026

   Fix path traversal via drive designator URI on Windows in TemplateLookup

   ...

   000ed85