CVE-2026-14361 PUBLISHED

Consul-template is vulnerable to path redirection in writeToFile through symlink attack

Assigner: HashiCorp
Reserved: 01.07.2026 Published: 08.07.2026 Updated: 08.07.2026

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 4.7

Attack Vector	Local	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	Tooling
Versions	Default: unaffected affected from 0.1.0 to 0.42.1 (excl.)

Credits

This issue was reported to HashiCorp by Mohamed Abdelaal (0xmrma).

References

https://discuss.hashicorp.com/t/hcsec-2026-20-consul-template-vulnerable-to-path-redirections-in-writetofile/77559

Problem Types

CWE-59: Improper Link Resolution Before File Access (Link Following) CWE

Impacts

CAPEC-132: Symlink Attack