CVE-2026-71215: art-template Path Traversal Vulnerability

CVE-2026-71215 Overview

CVE-2026-71215 is a path traversal vulnerability [CWE-22] in the art-template JavaScript templating engine. The flaw resides in the sub-template resolution logic at src/compile/adapter/resolve-filename.js, used by both the include() and extend() template directives. The resolver calls path.resolve(root, filename) without verifying that the resulting path remains within the root directory. Applications that let external input influence a sub-template name allow attackers to read arbitrary files accessible to the Node.js process.

Critical Impact
Remote unauthenticated attackers can read arbitrary files on disk through crafted template include parameters, exposing source code, configuration files, and secrets.

Affected Products

art-template Node.js templating library
Web applications passing user input into {{include page}} or {{extend page}} directives
Server-side rendered applications relying on art-template for view composition

Discovery Timeline

2026-08-05 - CVE-2026-71215 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71215

Vulnerability Analysis

The art-template engine resolves sub-template file names through path.resolve(root, filename). Node.js path.resolve() returns filename unchanged when it is an absolute path, discarding root entirely. The function also does not strip or reject ../ traversal sequences. The resolver returns the computed path directly to loader.js, which invokes fs.readFileSync() on it. The file contents are then compiled and rendered as a template, exposing their bytes in the response.

An attacker who controls the argument passed to include or extend can request paths such as /etc/passwd or ../../.env. The Node.js process reads and renders whatever file the operating system permits it to access. The vulnerability applies to CWE-22 Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing containment validation after path resolution. Secure implementations must call path.resolve() and then verify the result begins with the canonical root directory before passing it to file I/O.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker submits a request whose parameter feeds a {{include page}} or {{extend page}} directive with a traversal string or absolute path. The rendered response returns the file contents. See the GitHub art-template repository for source references.

Detection Methods for CVE-2026-71215

Indicators of Compromise

HTTP request parameters containing ../, ..\, or URL-encoded equivalents targeting template-rendering endpoints
Requests with absolute paths such as /etc/passwd, /proc/self/environ, or Windows paths in template name parameters
Anomalous fs.readFileSync reads from paths outside the application's template directory

Detection Strategies

Audit application code for include() and extend() calls where the template name derives from req.query, req.body, or req.params
Deploy web application firewall rules that block traversal sequences in parameters feeding template names
Instrument the Node.js runtime to log fs.readFileSync calls whose resolved paths fall outside the configured root

Monitoring Recommendations

Alert on outbound rendered responses containing content that resembles /etc/passwd, private keys, or .env variables
Monitor server logs for repeated 200-response requests to template endpoints with unusual query parameters
Correlate template rendering errors with parameter values containing path separators or encoded traversal patterns

How to Mitigate CVE-2026-71215

Immediate Actions Required

Identify all uses of art-template in your codebase and inventory endpoints where template names accept external input
Sanitize or whitelist template names before they reach include() or extend() directives
Restrict the Node.js process file system permissions using operating system controls or container mounts

Patch Information

Refer to the GitHub art-template repository for upstream fix status and release notes. Until a patched version is available, apply the workarounds below.

Workarounds

Validate template names against an allow-list of known-good identifiers before passing them into template directives
Reject any template name containing .., /, \, or a leading path separator, and normalize input before use
Wrap the resolver to call path.resolve() then verify the result starts with the canonical root directory, rejecting requests that fall outside it
Run the Node.js process under a least-privileged user account with read access limited to the template directory

bash

# Configuration example: containment check before file read
# Pseudocode illustrating the required post-resolve validation
# const resolved = path.resolve(root, filename);
# const canonicalRoot = path.resolve(root) + path.sep;
# if (!resolved.startsWith(canonicalRoot)) {
#   throw new Error('Template path outside allowed root');
# }