CVE-2026-120316 http4k CVE debrief

Who should care

Defenders responsible for systems using http4k, especially those with unauthenticated access, should assess exposure and prioritize verification and remediation efforts. This includes reviewing http4k versions, identifying potentially affected systems, and implementing necessary security measures to prevent unauthorized file reading and other potential impacts.

Why it matters

CVE-2026-120316 is a High-severity path traversal vulnerability in http4k that allows unauthenticated attackers to read files outside the baseTemplateDir. Defenders should prioritize verifying http4k versions, assessing exposure, and implementing remediation measures to prevent potential unauthorized file reading and other impacts.

• Potential unauthorized file reading due to path traversal.
• Possible impact on systems with sensitive data or configurations.
• Need for verification of http4k version and exposure.
• Prioritization of remediation based on system risk assessment.

Technical summary

The CVE-2026-120316 vulnerability in http4k before 6.62.0.0-ee allows attackers to read files outside the baseTemplateDir by manipulating template values. This is due to Thymeleaf's FileTemplateResolver resolving escaped paths without containment checks. The vulnerability has a CVSS score of 8.2 and is considered High severity. Defenders should prioritize verifying the version of http4k in use and assessing exposure to this vulnerability, especially in systems where unauthenticated access is possible. The exact scope of affected systems and the vendor's remediation plan require further verification from official sources.

Defensive priority

Defenders should prioritize verifying the version of http4k in use and assessing exposure to this vulnerability, especially in systems where unauthenticated access is possible.

Recommended defensive actions

• Verify the version of http4k in use and assess exposure to CVE-2026-120316.
• Restrict access to sensitive files and directories to prevent unauthorized reading.
• Implement additional monitoring to detect potential exploitation attempts.
• Update to version 6.62.0.0-ee or later if vulnerable.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. However, the exact scope of affected systems and the vendor's remediation plan require further verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.