CVE-2026-71215

Name of the Vulnerable Software and Affected Versions art-template (affected versions not specified)

Description Sub-template resolution logic in src/compile/adapter/resolve-filename.js, utilized by the include() and extend() template directives, fails to verify if the resolved file path remains within the intended root directory. The process uses path.resolve(root, filename), which allows absolute paths to override the root and permits the use of ../ traversal sequences. Since the resulting path is passed to fs.readFileSync() in loader.js for compilation and rendering, an attacker can read arbitrary files accessible to the Node process if the sub-template name is influenced by external input, such as a query parameter passed into {{include page}}.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.