What is the CVSS score of CVE-2026-71215?

CVE-2026-71215 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of art-template are affected by CVE-2026-71215?

art-template, a Node.js template rendering engine, contains an arbitrary file read vulnerability (CVE-2026-71215, CVSS 7.5) that allows unauthenticated attackers to access any file readable by the…

How to fix or mitigate CVE-2026-71215?

Within 24 hours: Identify all applications and infrastructure components using art-template by scanning package.json files, dependency manifests, and container images; conduct code review of template rendering logic to determine whether include() or extend() directives process any externally-controlled input. Within 7 days: For vulnerable applications, implement strict input validation to reject absolute paths and path traversal sequences (../) in template filenames; alternatively, restrict templates to a hardcoded whitelist and sandbox the Node.js process using filesystem-level controls (container policies, AppArmor, or SELinux) to deny access outside designated template directories. Within 30 days: Subscribe to art-template's security advisories; deploy patch version immediately upon vendor release and validate update in staging prior to production deployment. Maintain all compensating controls until patched version is fully deployed organization-wide.

art-template CVE-2026-71215

EUVD-2026-53212 HIGH

Path Traversal (CWE-22)

2026-08-05 TuranSec

GHSA-mj55-6q5h-prw4

Path Traversal Art Template

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

AC:H because exploitation requires a specific non-default application pattern - passing external input into template include directives - which is outside the attacker's control.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 08:01 vuln.today

CVE Published

Aug 05, 2026 - 06:59 cve.org

HIGH 7.5

DescriptionCVE.org

art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include() and extend() template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. Because path.resolve() discards root entirely when filename is an absolute path, and does not block '../' traversal sequences, and the resolved path is passed directly to fs.readFileSync() in loader.js with its contents compiled and rendered, an application that lets a sub-template name be influenced by external input (e.g. a query parameter passed into {{include page}}) allows an attacker to read arbitrary files on disk that the Node process can access.

AnalysisAI

Arbitrary file read in art-template's sub-template resolution logic exposes any file accessible to the Node.js process when application code passes externally-controlled input into include() or extend() template directives. The flaw exists in src/compile/adapter/resolve-filename.js, where path.resolve(root, filename) is called without any subsequent validation that the resolved path remains within the root directory - absolute paths silently discard root entirely, and relative traversal sequences (../) are not blocked. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N), exploitation is network-accessible and requires no authentication against vulnerable applications; however, no confirmed active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

art-template is a Node.js template engine (CPE: cpe:2.3:a:art-template:art-template:*:*:*:*:*:*:*:*) that supports sub-template inclusion via {{include}} and {{extend}} directives. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). In Node.js, path.resolve(root, filename) exhibits two dangerous behaviors when filename is attacker-controlled: if filename is an absolute path (e.g., /etc/passwd), path.resolve() ignores root entirely and returns the absolute path verbatim; if filename contains ../ sequences, they are resolved normally against root, allowing escape. The resolved path is passed without sanitization to fs.readFileSync() in loader.js, and the file contents are compiled and rendered by the template engine. The absence of any boundary check - such as verifying that resolved.startsWith(root + '/') - is the singular missing control that makes this exploitable.

RemediationAI

No vendor-released patch has been identified at time of analysis; fix availability should be tracked via the upstream repository at https://github.com/aui/art-template. As an immediate compensating control, application developers should impose an allowlist of permitted sub-template names - maintaining a set of valid template identifiers server-side and rejecting any include/extend filename not explicitly in that set before it reaches the art-template engine; this is the most effective mitigation with minimal side effects. Alternatively, strip or reject any filename containing ../ sequences or starting with / before passing to template directives, though denylist approaches carry bypass risk and are less reliable. Running the Node.js process under a dedicated, low-privilege OS user with a restricted file system view (e.g., via chroot or containerized environments with minimal filesystem mounts) limits the blast radius of exploitation by constraining which files fs.readFileSync() can access. Developers should audit all template files for {{include}} or {{extend}} directives that accept dynamic values derived from HTTP input and refactor them to use hardcoded template names wherever possible.