Consul-template Sandbox Path Bypass via Symlink (CVE-2020-5061)

Vulnerability Overview Title: HCSEC-2026-12 - Consul-template vulnerable to sandbox path bypass in file helper through symlink attack CVE ID: CVE-2020-5061 Publication Date: May 12, 2026 Summary: A sandbox path bypass vulnerability exists in the Consul-template library prior to version 0.42.0. This vulnerability allows reading files outside the sandbox. This issue (CVE-2020-5061) has been fixed in consul-template 0.42.0. Background: The file template function reads local files from disk and renders their content into the template output. It also monitors files for changes. When a file is modified, consul-template automatically re-renders the template. The restricts the paths that the local file function is allowed to read and ensures that the provided path is within a given directory tree. Details: During template evaluation, the file template helper enforces the , but subsequent dependency fetching reads the original input path without re-checking the . This creates a time-of-check to time-of-use vulnerability. An attacker can redirect a symlink after the initial validation but before the dependency fetch, allowing them to read files outside the sandbox. If the attacker restores the safe target before the next render, the second validation still passes, and the template consumes the cached out-of-sandbox content. Impact Affected Products/Versions: Consul-template up to 0.41.4 Fixed Version: 0.42.0 Remediation Customers should evaluate the risks associated with this issue and consider upgrading to consul-template 0.42.0. Acknowledgements This issue was reported to HashiCorp by Mohamed Abdelaal (0xmrra). We sincerely appreciate any efforts to coordinate the disclosure of security vulnerabilities. For information about security and security vulnerability reporting at HashiCorp, please visit https://hashicorp.com/security.

Goal Reached Thanks to every supporter — we hit 100%!

Consul-template Sandbox Path Bypass via Symlink (CVE-2020-5061)