CVE-2026-61632Proof of concept (PoC) published · CISASuited to automated attack · CISA
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
CVSS score
5.3
EPSS probability
%0.4
Risk score
0.0
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.5
CVE-2026-49477
Uncontrolled resource consumption in Facelessuser Soup Sieve
F
Patch verified Public Exploits:1EPSS %1
7.5
CVE-2026-49476
Uncontrolled resource consumption in Facelessuser Soup Sieve
F
Patch verified Public Exploits:1EPSS %1
7.5
CVE-2026-67422
pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
F
Patch verifiedEPSS %1
5.3
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
F
Patch status unknownEPSS %1
5.3
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
F
Patch status unknownEPSS %1
4.3
CVE-2026-46338
Path traversal in Facelessuser Pymdown Extensions
F
Patch verified Public Exploits:1EPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-61632"