Threats tagged 'ghsa-r83g-mhw3-hx4p'

A path traversal vulnerability exists in http4k versions before 6.62.0.0-ee within the ThymeleafTemplates Caching and HotReload feature. This flaw allows unauthenticated attackers to read arbitrary files outside the intended baseTemplateDir by using '../' segments in ViewModel.template() values. The vulnerability arises because Thymeleaf's FileTemplateResolver resolves escaped paths without proper containment checks, enabling disclosure of any file readable by the server process.