CVE-2026-61632

{
  "id": "CVE-2026-61632",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:11.410",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by <img src=\"...\"> by joining the src onto the configured base_path with os.path.normpath and opening the result directly, without verifying that the resolved path stays inside base_path. As a result, an src containing ../ sequences or an absolute path reads a file outside base_path as long as it has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg), and the file's contents are then base64-encoded into the rendered output, disclosing them. An application that renders untrusted Markdown with pymdownx.b64 enabled can therefore leak the contents of image-extension files readable by the process to whoever controls the Markdown or views the output, a targeted file-read bounded by the extension check. This issue has been fixed in version 11.0."
    },
    {
      "lang": "es",
      "value": "PyMdown Extensions es un conjunto de extensiones para el proyecto de markdown Python-Markdown. En versiones hasta la 10.21.3 inclusive, la extensión b64 es vulnerable a un salto de ruta que divulga archivos arbitrarios: incrusta imágenes referenciadas por menor queimg src=“...”mayor que al unir el src con el base_path configurado usando os.path.normpath y abriendo el resultado directamente, sin verificar que la ruta resuelta permanezca dentro de base_path. Como resultado, un src que contenga secuencias .. /  o una ruta absoluta lee un archivo fuera de base_path siempre que tenga una extensión de imagen permitida (.png, .jpg, .jpeg, .gif, .svg), y el contenido del archivo se codifica luego en base64 en la salida renderizada, divulgándolos. Una aplicación que renderiza Markdown no confiable con pymdownx.b64 habilitado puede, por lo tanto, filtrar el contenido de archivos con extensión de imagen legibles por el proceso a quien controle el Markdown o vea la salida, una lectura de archivo dirigida y limitada por la verificación de extensión. Este problema ha sido solucionado en la versión 11.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "facelessuser",
          "product": "pymdown-extensions",
          "versions": [
            {
              "version": "< 11.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T14:59:34.928697Z",
          "id": "CVE-2026-61632",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}