{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pymdown-extensions",
          "vendor": "facelessuser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.0.1, \u003c 10.21.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3."
    }
  ],
  "id": "CVE-2026-46338",
  "lastModified": "2026-07-16T19:16:45.733",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-16T19:16:45.733",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cf2110d9888f676efc0c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/pymdown-extensions/releases/tag/10.21.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.21.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pymdown-extensions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.1"
            },
            {
              "fixed": "10.21.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T20:00:29Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Summary\n\n`pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_path: True` (the default), the current `filename.startswith(base)` containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as `base_path`, such as `docs` vs `docs_internal`.\n\nThe regression was introduced in PR #2039 / commit `7c13bda5b7793b172efd1abb6712e156a83fe07d`, which replaced the original directory-identity check with a plain string-prefix comparison.\n\n# Details\n\nThe regression was introduced in commit `7c13bda5b7793b172efd1abb6712e156a83fe07d` (2023-05-15, #2039 *\"Fix regression of snippets nested deeply under specified base path\"*), which relaxed the original `os.path.samefile(base, os.path.dirname(filename))` check to a plain `startswith(base)`.\n\n`SnippetPreprocessor.get_snippet_path()` in `pymdownx/snippets.py`:\n\n```python\nif self.restrict_base_path:\n    filename = os.path.abspath(os.path.join(base, path))\n    # If the absolute path is no longer under the specified base path, reject the file\n    if not filename.startswith(base):\n        continue\n```\n\n`base` is `os.path.abspath(b)` and has no trailing separator. `str.startswith(base)` is `True` for any `filename` whose string representation begins with the same characters as `base`, regardless of whether those characters end at a directory boundary.\n\nConcrete example:\n\n* `base = \"/x/docs\"`\n* `path = \"../docs_secret/leak.txt\"` (inside the markdown snippet directive)\n* `os.path.join(base, path)` \u2192 `\"/x/docs/../docs_secret/leak.txt\"`\n* `os.path.abspath(...)`     \u2192 `\"/x/docs_secret/leak.txt\"`\n* `filename.startswith(base)` \u2192 `True`, because `\"/x/docs_secret/...\"` begins with the literal string `\"/x/docs\"`.\n\nAll releases from **10.0.1 (2023-05-15) through 10.21.2 (current)** are affected.\n\n# Impact\n\nArbitrary file read within the host the build runs on, bounded by the prefix match. With `base_path = /x/docs` the attacker can read files from any sibling directory whose path begins with the literal string `/x/docs` followed by any non-separator character \u2014 for example `/x/docs_internal/`, `/x/docs.bak/`, `/x/docs2/`.\n\nThe threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets.\n\n# Reproduction\n\nMinimal local PoC, non-destructive:\n\n```python\nimport os, shutil, tempfile, markdown\n\nwork = tempfile.mkdtemp(prefix=\"pmx_poc_\")\ntry:\n    base    = os.path.join(work, \"docs\")\n    sibling = os.path.join(work, \"docs_secret\")\n    os.makedirs(base)\n    os.makedirs(sibling)\n    with open(os.path.join(sibling, \"leak.txt\"), \"w\") as f:\n        f.write(\"TOP_SECRET_FROM_SIBLING_DIR\\n\")\n\n    out = markdown.markdown(\n        \u0027--8\u003c-- \"../docs_secret/leak.txt\"\\n\u0027,\n        extensions=[\"pymdownx.snippets\"],\n        extension_configs={\n            \"pymdownx.snippets\": {\n                \"base_path\": [base],\n                \"restrict_base_path\": True,\n                \"check_paths\": True,\n            }\n        },\n    )\n    print(out)  # -\u003e \u003cp\u003eTOP_SECRET_FROM_SIBLING_DIR\u003c/p\u003e\nfinally:\n    shutil.rmtree(work)\n```\n\nDefault `restrict_base_path: True` is sufficient \u2014 no non-default option is required.\n\n# Suggested fix\n\nMinimal change \u2014 require the separator after the base prefix:\n\n```diff\n-                        if not filename.startswith(base):\n+                        # Append `os.sep` so a sibling directory whose name shares a prefix\n+                        # (e.g. `/x/docs` vs `/x/docs_evil`) cannot satisfy the check.\n+                        if not filename.startswith(base + os.sep):\n                             continue\n```\n\nThis preserves the original intent (allow snippets nested at any depth under `base_path`) while restoring the directory-boundary check. It does not affect the `os.path.isdir(base)` branch where `base` is a file (that branch still uses `os.path.samefile`).\n\nAlternative: `os.path.commonpath([base, filename]) == base` is equivalent and slightly more idiomatic, though it raises `ValueError` on different drives on Windows and would need a `try/except`. The `startswith(base + os.sep)` fix is the smaller diff.\n\nNote: this fix does not change behaviour for symlinks inside `base_path`. The existing implementation uses `os.path.abspath` (not `os.path.realpath`), so a symlink within `base_path` pointing outside is still followed. That is a separate concern \u2014 symlinks require write access to `base_path`, a much higher bar than the current bypass \u2014 and matches the behaviour the CVE-2023 fix established.\n\n# Regression test\n\nA regression test class `TestSnippetsSiblingPrefix` was added in `tests/test_extensions/test_snippets.py`. It uses `tests/test_extensions/_snippets/nested` as `base_path` and a new fixture directory `tests/test_extensions/_snippets/nested_sibling_evil/leak.txt`. It asserts that the markdown directive `--8\u003c-- \"../nested_sibling_evil/leak.txt\"` raises `SnippetMissingError`.\n\n* Without fix: test fails (`AssertionError: SnippetMissingError not raised`, sibling file is silently read).\n* With fix: test passes.\n\nFull suite: `python -m pytest tests/ -q` \u2192 **738 passed** (737 baseline + 1 new regression test). No regressions.\n\n# Affected versions\n\n`\u003e= 10.0.1, \u003c= 10.21.2`",
  "id": "GHSA-62q4-447f-wv8h",
  "modified": "2026-05-19T20:00:29Z",
  "published": "2026-05-19T20:00:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/pymdown-extensions/pull/2039"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facelessuser/pymdown-extensions"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pymdown-extensions",
        "purl": "pkg:pypi/pymdown-extensions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.1"
            },
            {
              "fixed": "10.21.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.1",
        "10.1",
        "10.10",
        "10.10.1",
        "10.10.2",
        "10.11",
        "10.11.1",
        "10.11.2",
        "10.12",
        "10.13",
        "10.14",
        "10.14.1",
        "10.14.2",
        "10.14.3",
        "10.15",
        "10.16",
        "10.16.1",
        "10.17",
        "10.17.1",
        "10.17.2",
        "10.18",
        "10.19",
        "10.19.1",
        "10.2",
        "10.2.1",
        "10.20",
        "10.20.1",
        "10.21",
        "10.21.2",
        "10.3",
        "10.3.1",
        "10.4",
        "10.5",
        "10.6",
        "10.7",
        "10.7.1",
        "10.8",
        "10.8.1",
        "10.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46338",
    "GHSA-62q4-447f-wv8h"
  ],
  "details": "# Summary\n\n`pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_path: True` (the default), the current `filename.startswith(base)` containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as `base_path`, such as `docs` vs `docs_internal`.\n\nThe regression was introduced in PR #2039 / commit `7c13bda5b7793b172efd1abb6712e156a83fe07d`, which replaced the original directory-identity check with a plain string-prefix comparison.\n\n# Details\n\nThe regression was introduced in commit `7c13bda5b7793b172efd1abb6712e156a83fe07d` (2023-05-15, #2039 *\"Fix regression of snippets nested deeply under specified base path\"*), which relaxed the original `os.path.samefile(base, os.path.dirname(filename))` check to a plain `startswith(base)`.\n\n`SnippetPreprocessor.get_snippet_path()` in `pymdownx/snippets.py`:\n\n```python\nif self.restrict_base_path:\n    filename = os.path.abspath(os.path.join(base, path))\n    # If the absolute path is no longer under the specified base path, reject the file\n    if not filename.startswith(base):\n        continue\n```\n\n`base` is `os.path.abspath(b)` and has no trailing separator. `str.startswith(base)` is `True` for any `filename` whose string representation begins with the same characters as `base`, regardless of whether those characters end at a directory boundary.\n\nConcrete example:\n\n* `base = \"/x/docs\"`\n* `path = \"../docs_secret/leak.txt\"` (inside the markdown snippet directive)\n* `os.path.join(base, path)` \u2192 `\"/x/docs/../docs_secret/leak.txt\"`\n* `os.path.abspath(...)`     \u2192 `\"/x/docs_secret/leak.txt\"`\n* `filename.startswith(base)` \u2192 `True`, because `\"/x/docs_secret/...\"` begins with the literal string `\"/x/docs\"`.\n\nAll releases from **10.0.1 (2023-05-15) through 10.21.2 (current)** are affected.\n\n# Impact\n\nArbitrary file read within the host the build runs on, bounded by the prefix match. With `base_path = /x/docs` the attacker can read files from any sibling directory whose path begins with the literal string `/x/docs` followed by any non-separator character \u2014 for example `/x/docs_internal/`, `/x/docs.bak/`, `/x/docs2/`.\n\nThe threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets.\n\n# Reproduction\n\nMinimal local PoC, non-destructive:\n\n```python\nimport os, shutil, tempfile, markdown\n\nwork = tempfile.mkdtemp(prefix=\"pmx_poc_\")\ntry:\n    base    = os.path.join(work, \"docs\")\n    sibling = os.path.join(work, \"docs_secret\")\n    os.makedirs(base)\n    os.makedirs(sibling)\n    with open(os.path.join(sibling, \"leak.txt\"), \"w\") as f:\n        f.write(\"TOP_SECRET_FROM_SIBLING_DIR\\n\")\n\n    out = markdown.markdown(\n        \u0027--8\u003c-- \"../docs_secret/leak.txt\"\\n\u0027,\n        extensions=[\"pymdownx.snippets\"],\n        extension_configs={\n            \"pymdownx.snippets\": {\n                \"base_path\": [base],\n                \"restrict_base_path\": True,\n                \"check_paths\": True,\n            }\n        },\n    )\n    print(out)  # -\u003e \u003cp\u003eTOP_SECRET_FROM_SIBLING_DIR\u003c/p\u003e\nfinally:\n    shutil.rmtree(work)\n```\n\nDefault `restrict_base_path: True` is sufficient \u2014 no non-default option is required.\n\n# Suggested fix\n\nMinimal change \u2014 require the separator after the base prefix:\n\n```diff\n-                        if not filename.startswith(base):\n+                        # Append `os.sep` so a sibling directory whose name shares a prefix\n+                        # (e.g. `/x/docs` vs `/x/docs_evil`) cannot satisfy the check.\n+                        if not filename.startswith(base + os.sep):\n                             continue\n```\n\nThis preserves the original intent (allow snippets nested at any depth under `base_path`) while restoring the directory-boundary check. It does not affect the `os.path.isdir(base)` branch where `base` is a file (that branch still uses `os.path.samefile`).\n\nAlternative: `os.path.commonpath([base, filename]) == base` is equivalent and slightly more idiomatic, though it raises `ValueError` on different drives on Windows and would need a `try/except`. The `startswith(base + os.sep)` fix is the smaller diff.\n\nNote: this fix does not change behaviour for symlinks inside `base_path`. The existing implementation uses `os.path.abspath` (not `os.path.realpath`), so a symlink within `base_path` pointing outside is still followed. That is a separate concern \u2014 symlinks require write access to `base_path`, a much higher bar than the current bypass \u2014 and matches the behaviour the CVE-2023 fix established.\n\n# Regression test\n\nA regression test class `TestSnippetsSiblingPrefix` was added in `tests/test_extensions/test_snippets.py`. It uses `tests/test_extensions/_snippets/nested` as `base_path` and a new fixture directory `tests/test_extensions/_snippets/nested_sibling_evil/leak.txt`. It asserts that the markdown directive `--8\u003c-- \"../nested_sibling_evil/leak.txt\"` raises `SnippetMissingError`.\n\n* Without fix: test fails (`AssertionError: SnippetMissingError not raised`, sibling file is silently read).\n* With fix: test passes.\n\nFull suite: `python -m pytest tests/ -q` \u2192 **738 passed** (737 baseline + 1 new regression test). No regressions.\n\n# Affected versions\n\n`\u003e= 10.0.1, \u003c= 10.21.2`",
  "id": "PYSEC-2026-2999",
  "modified": "2026-07-13T16:05:54.875069Z",
  "published": "2026-07-13T15:19:09.231055Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/pymdown-extensions/pull/2039"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facelessuser/pymdown-extensions"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/pymdown-extensions"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-62q4-447f-wv8h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46338"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path"
}