CVE-2026-120316

{
  "etk_id": "ETK-2026-3260",
  "cve_id": "CVE-2026-120316",
  "display_id": "CVE-2026-120316",
  "ghsa_id": "GHSA-r83g-mhw3-hx4p",
  "euvd_id": "EUVD-2026-115005",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in http4k Thymeleaf template handling",
  "summary": "http4k releases earlier than 6.62.0.0-ee are affected when using ThymeleafTemplates caching or hot reload. An unauthenticated remote user may cause disclosure of files accessible to the application process if they can influence the template selected through a request.",
  "mitigation": "Upgrade http4k to version 6.62.0.0-ee or later. Until upgraded, disable request-controlled template selection and restrict the application's filesystem permissions.",
  "vendor": "http4k",
  "product": "http4k",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "org.http4k:http4k-template-thymeleaf"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "6.62.0.0-ee"
      ],
      "package_name": "org.http4k:http4k-template-thymeleaf",
      "purl": "pkg:maven/org.http4k/http4k-template-thymeleaf"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.005130183333332,
  "t0_at": "2026-11-02T02:01:14.357000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T02:01:14.357000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T02:01:14.357000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120316"
    }
  }
}