PJ@Npj8448
CVE-2026-120316: [dbu gs] Http4K Http4K · Path traversal · Public exploit/PoC available. https://pranithjain.qzz.io/blog/exploit-cve-2026-120316-cve-2026-120316-dbugs-http4k-http4k-path
0000052
93 followersView on X
CVE-2026-120316
LOWCVSS 8.2 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-22
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day