CVE-2026-71215 in art-template
Summary
by MITRE • 08/05/2026
art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include() and extend() template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. Because path.resolve() discards root entirely when filename is an absolute path, and does not block '../' traversal sequences, and the resolved path is passed directly to fs.readFileSync() in loader.js with its contents compiled and rendered, an application that lets a sub-template name be influenced by external input (e.g. a query parameter passed into {{include page}}) allows an attacker to read arbitrary files on disk that the Node process can access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability under examination involves a critical path traversal flaw in art-template's template processing engine, specifically within the sub-template resolution logic located in src/compile/adapter/resolve-filename.js. This issue affects both include() and extend() template directives that rely on path.resolve(root, filename) to determine target file paths without implementing proper containment checks. The fundamental flaw stems from how path.resolve() behaves when processing absolute paths, where it completely discards the root directory specification and allows arbitrary traversal sequences through '../' components. When an application permits external input to influence sub-template names, such as query parameters passed into template directives like {{include page}}, attackers can exploit this weakness to bypass intended security boundaries.
The technical implementation of this vulnerability demonstrates a classic path traversal attack vector where the absence of proper path validation creates an opportunity for arbitrary file access. The resolved file path, which may contain directory traversal sequences, gets directly passed to fs.readFileSync() in loader.js without any verification that the resulting path remains within the designated root directory boundaries. This design flaw enables attackers to craft malicious input that navigates outside the intended template directory structure and accesses sensitive files on the system that the Node.js process has permission to read. The vulnerability is particularly dangerous because it leverages legitimate template processing functionality to achieve unauthorized file system access, making detection more challenging.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable full system compromise when combined with other attack vectors. An attacker who can influence template parameters through user input can read configuration files, source code, database credentials, or other sensitive artifacts that the Node.js process can access. This represents a severe privilege escalation opportunity where the application's file system permissions directly translate into the attacker's ability to extract confidential data. The vulnerability aligns with CWE-22 Path Traversal and follows patterns documented in ATT&CK technique T1566 for credential access through file system manipulation. The attack surface is particularly broad since template engines are commonly used throughout web applications, making this a widespread potential risk.
Mitigation strategies should focus on implementing strict path validation within the template resolution logic to ensure all resolved paths remain within the designated root directory boundaries. The most effective approach involves adding explicit checks after path resolution to verify that the final file path is contained within the expected root directory using functions like path.relative() or similar containment verification mechanisms. Applications should also avoid passing external user input directly into template directives without sanitization, implementing proper input validation and normalization before any template processing occurs. Additionally, restricting template engine permissions through process isolation or privilege reduction techniques can limit the damage scope even if exploitation occurs. The fix should be implemented at the core resolution logic level to prevent any future variants of similar traversal attacks from being possible within the template processing pipeline.