CVE-2026-71215 art-template - Path Traversal in Sub-Template Resolution via include()/extend()
Attackers can read arbitrary files outside the template root directory by exploiting path traversal in the include and extend directives of the art-template library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71215?
CVE-2026-71215 is a high-severity path traversal vulnerability in art-template, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root.
Weakness: CWE-22
Which versions are affected by CVE-2026-71215?
How do I fix CVE-2026-71215?
No fix has been published for CVE-2026-71215 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-71215 being exploited?
There is no known exploitation of CVE-2026-71215 in the wild and no public exploit code.
Sources
Also known as GHSA-mj55-6q5h-prw4.