Technical impact
The consul‑template library contains a path‑redirection flaw in the writeToFile template helper. An attacker who supplies a crafted template can cause the rendered output to be written to a location outside the intended directory or to overwrite an existing file. This flaw allows unintended file creation or modification and could compromise configuration files, logs, or other sensitive data. The weakness is classified as CWE‑59 and has a CVSS score of 4.7, indicating a moderate severity impact on confidentiality and integrity.
Affected Systems
All installations of HashiCorp consul‑template prior to version 0.42.1 are affected. The vulnerability is triggered when the writeToFile helper is used to persist template output to disk; applications that render templates to the filesystem must ensure that the target file path is not controlled by an attacker or does not contain symlinks. The fixed version is 0.42.1, which eliminates the path‑redirection behavior.
Risk and Exploitability
The CVSS score of 4.7 reflects moderate risk, while the EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not in the CISA KEV catalog. Exploitation can be achieved by supplying a malicious template that references an absolute path or a symlink, and it requires the consul‑template process to run with sufficient privileges to write to the target location. Based on the description, it is inferred that the attack vector is the untrusted template input; mitigating privilege and input validation reduces the risk.
