Is CVE-2026-120316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120316 being exploited in the wild.

How severe is CVE-2026-120316?

Medium severity, with a CVSS score of 5.9, published 2 November 2026.

Which products and versions are affected?

Http4k-Template-Thymeleaf before 6.62.0.0-ee.

Is there a fix for CVE-2026-120316?

Yes: fixed in 6.62.0.0-ee. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120316 attacked?

It is attacked over the network.

Am I affected by CVE-2026-120316?

Check whether you run Http4k-Template-Thymeleaf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120316: http4k ThymeleafTemplates path traversal in template resolution

CVE-2026-120316 · Severity: medium · CVSS 5.9 · Published 2026-11-02

http4k is a Kotlin web framework that provides template rendering capabilities. A path traversal vulnerability in its Thymeleaf template engine allows unauthenticated attackers to read arbitrary files on the server by manipulating template selection parameters. An attacker can disclose sensitive files such as configuration, private keys, or source code that the server process has permission to access.

Vendors: Http4k.

Quick answers

Is CVE-2026-120316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120316 being exploited in the wild.
How severe is CVE-2026-120316?: Medium severity, with a CVSS score of 5.9, published 2 November 2026.
Which products and versions are affected?: Http4k-Template-Thymeleaf before 6.62.0.0-ee.
Is there a fix for CVE-2026-120316?: Yes: fixed in 6.62.0.0-ee. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120316 attacked?: It is attacked over the network.
Am I affected by CVE-2026-120316?: Check whether you run Http4k-Template-Thymeleaf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.62.0.0-ee

Technical details

The vulnerability exists in ThymeleafTemplates.Caching and ThymeleafTemplates.HotReload, which fail to validate that resolved template paths remain within the baseTemplateDir boundary. When a ViewModel's template() value is influenced by request data (e.g., path or query parameters), an attacker can inject ../ path traversal segments that the underlying Thymeleaf FileTemplateResolver resolves without containment checks. The fix requires canonicalizing and validating the resolved path before template processing, similar to the existing mitigation in Pug4jTemplates.

Affected products

http4k http4k-template-thymeleaf before 6.62.0.0-ee

Timeline

2026-10-16: disclosed
2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.