This vulnerability is a path‑traversal flaw in art‑template's sub‑template resolution logic. By supplying a template name that contains '../' or an absolute path to the include() or extend() directives, an attacker can cause the library to resolve a file outside the intended root directory and read its contents via fs.readFileSync. The impact is the remote read of arbitrary files accessible to the Node.js process, which constitutes a confidentiality breach. The CVSS score of 7.5 indicates high severity for this capability.

The flaw affects the art‑template library. No specific version range is identified in the CNA data, so any deployment that uses art‑template and has not been updated with the latest patch may be vulnerable. All users of versions older than the last fix should consider themselves impacted.

The CVSS score of 7.5 reflects high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an attacker influencing the template name parameter—such as a query string that is passed directly to {{include page}}—without proper validation. Successful exploitation requires that the Node.js process has read access to the target files; no authentication or elevated privileges are required beyond the process's inherent permissions.