{"id":"CVE-2026-71215","published":"2026-08-05T08:16:43.940","lastModified":"2026-08-10T12:17:25.420","description":"art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/aui/art-template","tags":[]}],"exploitRefs":[{"url":"https://github.com/aui/art-template","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows path traversal by not validating the resolved file path after using path.resolve, potentially leading to unauthorized access or execution of files.","exploitability":"Exploitation requires control over template filenames and knowledge of the root directory structure; moderate difficulty.","blast_radius":"If exploited, it could lead to data exposure or code execution on the server hosting the affected application.","remediation":"Implement path validation checks after resolving the file path to ensure it remains within the intended root directory.","tags":["rce","path-traversal","web","template-injection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:59:02.315Z"}}