http4k Thymeleaf CVE-2026-120316

Requires the application to use ThymeleafTemplates(...).Caching(baseTemplateDir) or .HotReload(baseTemplateDir) AND to let request-controlled data reach the value returned by ViewModel.template() (or the ::selector suffix) - for example per-tenant, per-locale, or per-page template selection driven by a path or query parameter. Under those conditions it is remote and unauthenticated (PR:N), needing no user interaction. Key limiters: it is NOT exploitable against applications that use a fixed/non-request-derived template name, and it is specific to the Thymeleaf engine - http4k's Pug4j wrapper (via the containment check in commit 725f1b9697) and the Handlebars (4.5.5), FreeMarker, and Pebble (4.1.2) engines at their pinned versions are not affected. Impact is limited to disclosure of files readable by the server process; no write or code execution is claimed.

This is a credible but conditional file-disclosure flaw rather than a mass-exploitation emergency. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) describes a remote, unauthenticated vector with high attack complexity and a present attack requirement (AT:P), and impact limited to confidentiality (VC:H; VI:N/VA:N) - consistent with arbitrary server-side file read and no write or availability effect. The vuln.today decision label is 'this_week' (not act_now/emergency), and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. No EPSS probability was provided in the input, so widespread-exploitation likelihood cannot be quantified here. The GHSA advisory includes a detailed, verified reproduction against http4k's real pinned Thymeleaf 3.1.5.RELEASE, so the technical defect is solidly confirmed - but the AC:H/AT:P rating reflects a real limiter: exploitation only works when the consuming application routes request-controlled data into ViewModel.template(), which the advisory explicitly states it did NOT demonstrate against a deployed http4k app. Net: a genuine, confirmed vulnerability worth patching on a near-term schedule matching the 'this_week' label, but its real-world reach depends entirely on application design, so treat raw severity (8.2) as an upper bound gated by whether request data reaches template selection.

An http4k application uses ThymeleafTemplates(...).Caching or .HotReload and selects templates using a request-influenced value (e.g. per-tenant, per-locale, or per-page selection driven by a path or query parameter). A remote, unauthenticated attacker supplies a template() value containing ../ segments to escape baseTemplateDir and read the contents of any file the server process can read. A verified reproduction harness exists in the GHSA advisory against the real pinned Thymeleaf 3.1.5.RELEASE library, though it was not demonstrated end-to-end against a full deployed http4k application.