CVE-2026-14361 — Consul-template is vulnerable to path redirection in writeToFile through symlink attack

CVE-2026-14361

Consul-template is vulnerable to path redirection in writeToFile through symlink attack PUBLISHED

Description (CNA)

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Tooling	affected 0.1.0 before 0.42.1

CWE

CWE-59

References

https://discuss.hashicorp.com/t/hcsec-2026-20-consul-template-vulnerable-to-path-redirections-in-writetofile/77559

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.