CVE-2026-120316 in Http4k
Summary
by MITRE • 11/02/2026
http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in http4k versions prior to 6.62.0-ee represents a critical path traversal flaw within its Thymeleaf template engine integration, specifically affecting the Caching and HotReload mechanisms. This security defect arises from an insufficient validation of user-supplied input when determining which template file should be rendered or reloaded during runtime. The core technical failure lies in how the application processes ViewModel.template() values provided by clients. When a request is made to select a specific view model, the underlying Thymeleaf FileTemplateResolver attempts to resolve the corresponding physical file path on the server's filesystem. However, the implementation fails to enforce strict containment checks that would restrict access solely to the designated base template directory. Consequently, an attacker can manipulate this input by injecting relative path traversal sequences, such as ../ segments, into the ViewModel.template() parameter.
From a technical perspective, the flaw exploits the way Java-based web frameworks typically resolve file paths. When Thymeleaf receives a template name containing these traversal characters, it constructs a file system path that moves up directories from the base root. Because there is no sanitization or canonicalization step to verify that the resulting absolute path remains within the allowed boundaries of the application's resource directory, the server proceeds to read and serve the content of files located outside this scope. This behavior effectively bypasses standard access controls designed to isolate web application resources from sensitive system files. The vulnerability allows for unauthenticated remote exploitation, meaning any external actor with network connectivity to the http4k service can trigger this condition without needing valid credentials or prior authentication sessions.
The operational impact of this vulnerability is severe, primarily centering on unauthorized information disclosure and potential data exfiltration. By successfully exploiting this path traversal mechanism, an attacker gains the ability to read arbitrary files accessible by the server process running the http4k application. This includes sensitive configuration files containing database credentials or API keys, internal source code that may reveal further architectural weaknesses, operating system logs, or other confidential documents stored on the host machine. In environments where the web service runs with elevated privileges, this could lead to a complete compromise of the underlying infrastructure. The ability to read these files serves as a critical foothold for attackers to pivot into deeper network segments or escalate their access rights through subsequent exploitation steps based on the harvested data.
This vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements that can cause paths to traverse outside the intended directory structure. Furthermore, in terms of offensive security frameworks, this exploit technique corresponds to ATT&CK T1083: File and Directory Discovery, as it enables an adversary to enumerate and access sensitive files on a compromised system. The lack of input validation for file path parameters is a common pattern in web application vulnerabilities that often leads to significant data breaches if left unpatched.
To mitigate this risk, organizations running http4k must immediately upgrade to version 6.62.0-ee or later, where the developers have implemented proper containment checks within the ThymeleafTemplates Caching and HotReload logic. These updates ensure that any requested template path is validated against a whitelist of allowed directories before being passed to the file resolver. In addition to upgrading, administrators should enforce strict input validation on all parameters influencing resource selection, ensuring that only alphanumeric characters and safe delimiters are accepted for template names. Implementing defense-in-depth strategies such as running web services with minimal filesystem permissions can also limit the blast radius of any successful exploitation attempt by restricting which files the server process is authorized to read regardless of path traversal attempts.