CVE-2026-5061 — Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack

CVE-2026-5061

Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack PUBLISHED

Description (CNA)

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Tooling	affected 0.1.0 before 0.42.0

CWE

CWE-59

References

https://discuss.hashicorp.com/t/hcsec-2026-12-consul-template-vulnerable-to-sandbox-path-bypass-in-file-helper-through-symlink-attack/77414

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.