Read the docs
TI-2026-34058 Aliases CVE-2026-46338GHSA-62q4-447f-wv8h

Path traversal in facelessuser pymdown-extensions

Priority MEDIUM 53CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pymdown-extensions (facelessuser): 10.21.3pymdown-extensions (PyPI): 10.21.3Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
facelessuserpymdown-extensions10.0.1 to before 10.21.310.21.3Patch availableCNA
—pymdown-extensions (PyPI)10.0.1 to before 10.21.310.21.3Patch availableGHSA-62q4-447f-wv8h
  • pymdown-extensions Vendorfacelessuser Affected 10.0.1 to before 10.21.3 Fixed in 10.21.3 Patch available CNA
  • pymdown-extensions (PyPI) Vendor— Affected 10.0.1 to before 10.21.3 Fixed in 10.21.3 Patch available GHSA-62q4-447f-wv8h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facelessuser:pymdown_extensions:*:*:*:*:*:*:*:*10.0.1 to before 10.21.3Vulnerablefacelessuser
  • cpe:2.3:a:facelessuser:pymdown_extensions:*:*:*:*:*:*:*:* Versions 10.0.1 to before 10.21.3 Vulnerable ·facelessuser

Remediation

  • Fix · CNA pymdown-extensions (facelessuser) Fixed in 10.21.3
  • Fix · GHSA-62q4-447f-wv8h pymdown-extensions (PyPI) Fixed in 10.21.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46338
  2. 2026-10-03 Alias added: GHSA-62q4-447f-wv8h
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Other 3

  • TI-2023-15603 Arbitrary file inclusion with the pymdowm-snippets extension CVSS 3.1HIGH 7.5
  • TI-2025-41723 PyMdown Extensions has ReDOS bug in Figure Capture extension CVSS 4.0LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences