CVE-2026-14361

MediumCVSS 4.7

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper, which may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability is fixed in consul-template 0.42.1.

Risk Assessment

The risk involves unauthorized file writes outside the intended directory, potentially overwriting critical system or configuration files, leading to system integrity compromise.

Recommendation

Immediately upgrade consul-template to version 0.42.1 or later, which contains the fix for this vulnerability.

Other vulnerabilities in consul-template

CVE-2026-87993High
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events.

Original NVD description (English source)

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS