{"id":"CVE-2026-120316","kind":"vulnerability","aliases":["CVE-2026-120316"],"related":[],"title":"http4k: path traversal in Thymeleaf templates lets attackers read server files","description":"http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.","summary":"http4k's Thymeleaf template caching and hot-reload code does not contain template paths, so ../ segments in view template names escape the template directory. An unauthenticated attacker can read any file the server process can read.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http4k","java","jvm","kotlin","package","thymeleaf"],"not_affected_if":["fixed-template-names","no-thymeleaf"],"how_to_check":"- Check the http4k version in the build file (for example `build.gradle` or `pom.xml`) and see whether it is below `6.62.0.0-ee`.\n- Look for `ThymeleafTemplates` with Caching or HotReload enabled, and for views where `ViewModel.template()` takes values from request input.","fix":"- http4k: move to `6.62.0.0-ee` or later.","status":"open","published_at":"2026-11-02T03:17:29+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","triaged_at":"2026-11-02T03:31:50+00:00","updated_at":"2026-11-02T03:31:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T03:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- http4k: move to `6.62.0.0-ee` or later.","reach":"internet","title":"http4k: path traversal in Thymeleaf templates lets attackers read server files","impact":"high","summary":"http4k's Thymeleaf template caching and hot-reload code does not contain template paths, so ../ segments in view template names escape the template directory. An unauthenticated attacker can read any file the server process can read.","audience":"developers","category":"package","nicknames":[],"who_cares":["http4k","thymeleaf","kotlin","java","jvm"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker reads any file the server process can read","analyst_note":"Confirm the default values for Caching and HotReload in the http4k Thymeleaf module, and check the NVD entry for any extra detail.","how_to_check":"- Check the http4k version in the build file (for example `build.gradle` or `pom.xml`) and see whether it is below `6.62.0.0-ee`.\n- Look for `ThymeleafTemplates` with Caching or HotReload enabled, and for views where `ViewModel.template()` takes values from request input.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-template-names","no-thymeleaf"],"who_is_affected":"Teams that build services on http4k with the Thymeleaf template integration, where Caching or HotReload is on and the template name comes from request data. Applications that use fixed template names, or that do not use the Thymeleaf integration, are not exposed. unknown whether default settings enable Caching or HotReload.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4185,"output_tokens":592,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120316':14A,17A '-2026':13A,16A '6.62.0.0':63C 'allow':76C 'attack':8A,51B,78C,90C 'basetemplatedir':83C 'cach':28B,72C 'check':107C 'code':33B 'contain':36B,65C,106C 'cve':12A,15A 'directori':48B 'disclos':108C 'driven':95C 'ee':64C 'escap':45B,103C 'file':11A,55B,81C,110C 'filetemplateresolv':101C 'hot':31B 'hot-reload':30B 'hotreload':74C 'http4k':1A,18B,24B,61C 'influenc':92C 'java':19B 'jvm':20B 'kotlin':21B 'let':7A 'name':44B 'outsid':82C 'packag':22B 'path':2A,38B,67C,104C 'process':58B,115C 'read':9A,53B,60B,80C 'readabl':111C 'reload':32B 'request':94C 'request-driven':93C 'resolv':102C 'segment':40B,86C 'select':97C 'server':10A,57B,114C 'suppli':85C 'templat':6A,27B,37B,43B,47B,96C 'thymeleaf':5A,23B,26B,99C 'thymeleaftempl':71C 'travers':3A,68C 'unauthent':50B,77C 'valu':89C 'view':42B 'viewmodel.template':88C 'vulner':69C 'without':105C","nicknames":[],"mitigations":[],"who_affected":"Teams that build services on http4k with the Thymeleaf template integration, where Caching or HotReload is on and the template name comes from request data. Applications that use fixed template names, or that do not use the Thymeleaf integration, are not exposed. unknown whether default settings enable Caching or HotReload.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","http4k","java","jvm","kotlin","package","thymeleaf"],"first_public_at":"2026-11-02T03:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120316","severity":null,"published_at":"2026-11-02T03:17:29+00:00","modified_at":"2026-11-02T03:17:29+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","fetched_at":"2026-11-02T03:31:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}