art-template vulnerabilities

Products

• art-template 1

Latest art-template CVEs

Newest publication first

1. CVE-2026-71215 art-template - Path Traversal in Sub-Template Resolution via include()/extend()

   Published 2026-08-05

   High·CVSS 7.5 EPSS 0.56%

   art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.