Summary
art-template contains a path traversal vulnerability in the resolution of files referenced by the include() and extend() directives. When an application allows external input to influence a sub-template name, an attacker may read arbitrary files accessible to the Node.js process.
Affected context
The vulnerability may occur in applications using art-template's include() or extend() directives when a sub-template path is derived from user-controlled or otherwise untrusted input. The risk is greatest when the application passes values such as request parameters into template resolution without constraining them to an approved set of files.
Exploit preconditions
- Attack surface: Template rendering functionality using
include()orextend() - Required access: Ability to influence the sub-template name or resolved filename
- Trigger point: Sub-template resolution followed by file loading and compilation
- Why exploitation is possible: The resolved path is used without verifying that it remains within the intended template root, allowing absolute paths or traversal sequences to escape that directory
Why this happens
The underlying bug is insufficient path containment validation. The resolver combines a trusted root with a filename using path.resolve() but does not verify that the resulting canonical path remains beneath the intended root. Absolute filenames can replace the root, while parent-directory segments can move the result outside it. This behavior maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Potential impact
- An attacker may read application configuration files
- Secrets, credentials, or environment-related data could be exposed
- Source code and template contents may be disclosed
- Information obtained from the host could support further compromise
- Sensitive data may be rendered through an application response or error path
General mitigation guidance
Mitigation generally focuses on reducing trust in template names and enforcing
path containment before any file is opened.
Common defensive patterns include:
- Restricting sub-template selection to an explicit allowlist or fixed mapping
- Resolving and canonicalizing candidate paths before access
- Verifying that the canonical result is within the designated template root
- Rejecting absolute paths and parent-directory traversal components
- Keeping template directories separate from secrets and sensitive application files
- Running the Node.js process with least-privilege filesystem permissions
- Avoiding dynamic template inclusion when a static template reference is sufficient
How teams detect issues like this
Organizations can look for this vulnerability through:
- Static analysis rules identifying user-controlled data flowing into
include() or extend() template names
- Code review checks for
path.resolve()or similar path joins without a
subsequent containment check
- Tests covering absolute paths, parent-directory components, symlinks, and
encoded path representations
- Runtime policies that limit template access to approved directories
- Monitoring for unexpected file reads during template rendering
Automated code review and security scanning tools may help identify unsafe
data flows and missing path-boundary validation.
