---
id: CVE-2026-120316
title: >-
  http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template
  Resolution
summary: >-
  http4k before 6.62.0.0-ee contains a path traversal vulnerability in
  ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers
  to read files outside baseTemplateDir by supplying ../ segments in
  ViewModel.template() v…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: http4k
product: http4k
affected:
  - http4k < 6.62.0.0-ee
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:04:24.950853Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:38:29.758Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120316'
references:
  - url: 'https://github.com/http4k/http4k/security/advisories/GHSA-wq4x-r858-gmmj'
    label: GitHub Security Advisory (GHSA-wq4x-r858-gmmj)
  - url: >-
      https://www.vulncheck.com/advisories/http4k-before-6.62.0.0-ee-path-traversal-via-thymeleaftemplates-template-resolution
    label: >-
      VulnCheck Advisory: http4k before 6.62.0.0-ee Path Traversal via
      ThymeleafTemplates Template Resolution
tags:
  - cve.org
epss: 0.00309
epssPercentile: 0.23858
ingestedAt: '2026-11-05T19:30:42.739Z'
---

## Overview

http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.

## Affected

- `http4k < 6.62.0.0-ee`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.