http4k before version 6.62.0.0-ee contains a path traversal flaw in its ThymeleafTemplates caching and hot‑reload mechanism. An attacker can supply a template name containing "../" segments via the ViewModel.template() value. Thymeleaf’s FileTemplateResolver does not perform containment checks on the resulting path, allowing the server process to read any file that is readable by that process. This leads to unauthorized disclosure of file contents with no requirement for elevated privileges or authentication.

All deployments of http4k using the ThymeleafTemplates component and running a version older than 6.62.0.0-ee are affected. The vulnerability specifically impacts the file resolution logic within the Http4k library as distributed by the http4k vendor.

The CVSS score of 8.2 indicates a high severity vulnerability that can be exploited remotely by sending HTTP requests containing crafted template names. Because no authentication is required and the attack vector is network‑based, attackers with network access to the application can trigger the flaw. The EPSS score is not available, and the issue is not listed in CISA KEV, but the combination of high CVSS, lack of containment checks, and unauthenticated access results in a significant risk of information leakage in environments where insecure template directories are used. The attack path is straightforward: an HTTP request to the application containing a template name with "../" segments triggers the resolver, which then reads arbitrary files from the server’s file system.