Skip to content
OpenAdvisories
Medium · 4.7 Public exploit CVE-2026-14361 EUVD-2026-42346GHSA-xcm7-pmg9-8wjq

Consul-template is vulnerable to path redirection in writeToFile through symlink attack

Published Jul 8, 2026 · Updated Jul 8, 2026 · Assigned by HashiCorp

Vendor: HashiCorp Product: Tooling

Description

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.

Affected products

VendorProductAffectedFixed
HashiCorp Tooling 0.1.0 – < 0.42.1 0.42.1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 0xmrma/CVE-2026-14361 ★ 0 · Aug 1, 2026

    Consul Template's writeToFile helper opened an operator-supplied destination directly and followed linked path components, allowing rendered output to escape the intended directory and overwrite a pr…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References