We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 72e10c5 commit 2fb24d8Copy full SHA for 2fb24d8
1 file changed
doc/build/unreleased/435.rst
@@ -5,6 +5,5 @@
5
Fixed issue in :class:`.TemplateLookup` where a URI with backslash path
6
separators (e.g. ``\..\secret.txt``) could bypass the directory traversal
7
check on Windows, allowing reads of arbitrary files outside of the template
8
- directory. This is an incomplete fix for :cve:`2026-41205`. Backslash
9
- characters in URIs are now normalized to forward slashes before path
10
- resolution.
+ directory. Backslash characters in URIs are now normalized to forward
+ slashes before path resolution.
0 commit comments