Art Template
Monthly
Arbitrary file read in art-template's sub-template resolution logic exposes any file accessible to the Node.js process when application code passes externally-controlled input into include() or extend() template directives. The flaw exists in src/compile/adapter/resolve-filename.js, where path.resolve(root, filename) is called without any subsequent validation that the resolved path remains within the root directory - absolute paths silently discard root entirely, and relative traversal sequences (../) are not blocked. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N), exploitation is network-accessible and requires no authentication against vulnerable applications; however, no confirmed active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Arbitrary file read in art-template's sub-template resolution logic exposes any file accessible to the Node.js process when application code passes externally-controlled input into include() or extend() template directives. The flaw exists in src/compile/adapter/resolve-filename.js, where path.resolve(root, filename) is called without any subsequent validation that the resolved path remains within the root directory - absolute paths silently discard root entirely, and relative traversal sequences (../) are not blocked. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N), exploitation is network-accessible and requires no authentication against vulnerable applications; however, no confirmed active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.