CVE-2026-120316: http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution

Published Nov 2, 2026

Updated

http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.

Event History

Nov 2, 2026

CVE Published

via OSV·02:01 AM

Data Sourced

via OSV·02:01 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using http4k before 6.62.0.0-ee are exposed when they use ThymeleafTemplates Caching or HotReload and permit request-driven selection of ViewModel.template() values. The impact is limited to files that the server process can read.

What does an attacker need to exploit the vulnerability?

An attacker does not need authentication or user interaction, but must be able to influence the template value passed to ViewModel.template(). Exploitation uses ../ path segments to escape baseTemplateDir during Thymeleaf template resolution.

What can be done if upgrading is not immediately possible?

Prevent untrusted request data from controlling ViewModel.template() values. Restrict template selection to a fixed allowlist of known template names and reject path separators or traversal sequences such as ../.

How can teams assess whether their application may be affected?

Review uses of ThymeleafTemplates Caching and HotReload and trace the source of every ViewModel.template() value. An application may be affected if a request parameter, route value, header, body field, or other attacker-controlled input can determine that template name.

CVE-2026-120316: http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What can be done if upgrading is not immediately possible?

How can teams assess whether their application may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What can be done if upgrading is not immediately possible?

How can teams assess whether their application may be affected?