The CVE is a path‑traversal flaw in art‑template's sub‑template resolution logic (src/compile/adapter/resolve‑filename.js) used by both the include and extend directives. It resolves the target file path via path.resolve(root, filename) without checking that the resolved path remains inside the intended root directory. By supplying a template name that contains ‘../’ or an absolute path, an attacker can cause the library to read files outside the root via fs.readFileSync. This results in a remote read of arbitrary files accessible to the Node.js process, constituting a confidentiality breach. The CVSS score of 7.5 indicates high severity.

The flaw affects the art‑template library. No specific version range is identified in the CNA data, so any deployment that uses art‑template and has not been updated with the latest patch may be vulnerable. All users of versions older than the last fix should consider themselves impacted.

The CVSS score of 7.5 indicates high severity. The EPSS score of 0.00372 (~0.4%) shows a very low probability of exploitation, although not impossible. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an attacker influencing the template name parameter—such as a query string that is passed directly to {{include page}}—without proper validation. Successful exploitation requires that the Node.js process has read access to the target files; no authentication or elevated privileges are required beyond the process's inherent permissions.