The vulnerability resides in the file template helper of consul-template, allowing a sandbox path bypass that can expose files outside the intended directory. An attacker who can influence the template configuration may create a symbolic link that points to sensitive files, causing the helper to resolve and read the target file despite sandbox protection. The impact is the disclosure of confidential data from within the host system, as the attacker gains read access to arbitrary files located outside the sandboxed area.

HashiCorp tooling – the Consul‑Template component in versions prior to 0.42.0 is affected. Versions older than 0.42.0 inherit the ability to resolve symbolic links within the sandbox, enabling the path traversal described.

The CVSS score of 4.7 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Because the attacker must manipulate the template configuration to insert a malicious symlink, the condition of exploitation requires some level of access to the template files or the ability to influence rendering. Nonetheless, the potential to read arbitrary files poses a significant confidentiality risk.