high · CVSS v3 5.9 · CVSS v4 8.2

CVE-2026-120316

CVE-2026-120316 is a path traversal vulnerability in http4k's ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers

Overview

CVE-2026-120316 is a path traversal vulnerability in http4k's ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read arbitrary files on the server by manipulating template names. The flaw exists in all versions before 6.62.0.0-ee and can expose any file readable by the server process.

Description

http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.

Impact

Confidentiality: attackers can read any file readable by the server process, potentially exposing sensitive data. Integrity and availability are not directly impacted. Defenders include application owners, DevOps, and security teams who must address the flaw.

Remediation

Upgrade http4k to version 6.62.0.0-ee or later. If an upgrade is not immediately possible, disable ThymeleafTemplates Caching and HotReload or restrict the baseTemplateDir to a safe location and enforce strict path validation. Additionally, apply file system permissions to limit the server process’s read access to only necessary files.

Risk context

The vulnerability has a high severity rating with a CVSS v4 score of 8.2, indicating a significant risk level. Immediate attention and remediation are recommended to prevent potential data exposure.

Affected products

  • http4k

Scores

Severity
high
CVSS v2
5.4
CVSS v3
5.9
CVSS v4
8.2
EPSS
—

path-traversal Thymeleaf http4k file-read high-severity

← All CVEs

Related CVEs

high

CVE-2026-120313

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.

View analysis

high

CVE-2026-120314

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

View analysis

high

CVE-2026-120317

The http4k library contains a missing integrity check that allows an attacker to modify the body of authenticated requests on non‑TLS channels without invalidating the Authorization header. This can enable unauthorized state‑changing actions performed as the victim. The issue affects all versions prior to 6.60.0.0.

View analysis

high

CVE-2026-120324

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.

View analysis