CVE-2026-61632

Received Received - Intake

Path Traversal in PyMdown Extensions via b64 Extension

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by <img src="..."> by joining the src onto the configured base_path with os.path.normpath and opening the result directly, without verifying that the resolved path stays inside base_path. As a result, an src containing ../ sequences or an absolute path reads a file outside base_path as long as it has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg), and the file's contents are then base64-encoded into the rendered output, disclosing them. An application that renders untrusted Markdown with pymdownx.b64 enabled can therefore leak the contents of image-extension files readable by the process to whoever controls the Markdown or views the output, a targeted file-read bounded by the extension check. This issue has been fixed in version 11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-61632

Affected Vendors & Products

Vendor	Product	Version / Range
pygments	markdown	to 10.21.3 (inc)
pygments	markdown	11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

PyMdown Extensions is a set of extensions for Python-Markdown. The b64 extension in versions up to 10.21.3 has a path traversal vulnerability. It allows inline images via <img src='...'> tags by joining the src path with a base_path without proper validation. Attackers can use ../ sequences or absolute paths to read files outside the base_path if they have allowed image extensions (.png, .jpg, .jpeg, .gif, .svg). The file contents are then base64-encoded into the output, leaking sensitive data.

Detection Guidance

To detect this vulnerability, check if PyMdown Extensions version 10.21.3 or earlier is installed. Run: pip show pymdown-extensions. If the version is <=10.21.3, the system is vulnerable. Inspect Markdown files processed by applications using pymdownx.b64 for <img> tags with src attributes pointing outside the base_path.

Impact Analysis

If you use an affected version of PyMdown Extensions with pymdownx.b64 enabled, an attacker could craft malicious Markdown to read sensitive files on your system. This includes files with image extensions readable by the process. The attacker could then view the base64-encoded contents of those files, potentially exposing confidential or sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive data, such as personal or health information. Under GDPR, this may result in violations of data protection principles and potential fines. For HIPAA, it could constitute a breach of protected health information, requiring notifications and corrective actions. Compliance programs may be impacted due to increased risk of data exposure.

Mitigation Strategies

Upgrade PyMdown Extensions to version 11.0 or later immediately. Run: pip install --upgrade pymdown-extensions. Disable the b64 extension in Markdown processing if not required. Review and restrict file permissions for the application process to limit potential file access.

Hi! I’m here to help you understand CVE-2026-61632. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70