NVD security advisoryHigh
High advisory for http4k
CVE-2026-120316 · Reported 2 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
http4kAffected product
Advisory overview
http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.