Live › vulnerability › CVE-2026-120316
http4k's Thymeleaf template caching and hot-reload code does not contain template paths, so ../ segments in view template names escape the template directory. An unauthenticated attacker can read any file the server process can read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Teams that build services on http4k with the Thymeleaf template integration, where Caching or HotReload is on and the template name comes from request data. Applications that use fixed template names, or that do not use the Thymeleaf integration, are not exposed. unknown whether default settings enable Caching or HotReload.
No product ranges from the sources yet.
build.gradle or pom.xml) and see whether it is below 6.62.0.0-ee.ThymeleafTemplates with Caching or HotReload enabled, and for views where ViewModel.template() takes values from request input.6.62.0.0-eeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.
This page as .md · .json · in your agent: get_signal("CVE-2026-120316")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.