CVE Feed

    Dashboard / CVE / CVE-2026-120316

    CVE-2026-120316

    http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.

    Published:Nov 2, 2026
    Last Modified:Nov 2, 2026
    EPS:Nov 2, 2026
    EPSS Score:
    CVSS Score:5.9

    Affected Products

    Vendor
    Http4k
    Product
    Http4k

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-120317 (CVSS 8.2) — http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder co…
    CVE-2026-100834 (CVSS 8.2) — http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 a…
    CVE-2026-100725 (CVSS 8.3) — http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStor…
    CVE-2026-100724 (CVSS 6.3) — http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains)…
    CVE-2026-54147 (CVSS 6.5) — http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, Digest…
    CVE-2026-54148 (CVSS 8.1) — http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, Digest…
    CVE-2026-53659 (CVSS 7.5) — http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, Server…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High