The CVSS 7.5 rating for CVE-2026-71215 obscures a critical precondition: this path traversal bug in art-template is only exploitable when an attacker controls the filename argument passed to the include or extend directives. If they can inject template syntax directly, they've already achieved code execution—making this traversal a secondary concern. But if template sources are trusted (admin-authored, stored in vetted directories) while filenames within those templates come from untrusted input (query parameters, API payloads), this becomes the primary attack vector.
The deeper problem is an API design failure. The include and extend directives accept raw filenames without any signal that this represents a security boundary requiring validation. The documentation shows usage like {{include "./partial.html"}}, normalizing the mental model that these are template-relative paths rather than arbitrary file references needing containment. A developer passing {{include filename}} where filename originates from user input may not recognize they've crossed from application logic into a library trust boundary.
This vulnerability exists because art-template evolved in a different lineage than Jinja2, Nunjucks, or Pug—engines that absorbed path traversal lessons through their own CVE cycles between 2015-2019. art-template never inherited that institutional memory. The absence isn't negligence; it's evolutionary isolation.
The blast radius matters: the template rendering pipeline often accesses application configs, environment variables, session artifacts, and secrets. Arbitrary file read from this context can expose database credentials, JWT secrets, or internal API keys that enable lateral movement—even if direct code execution is blocked elsewhere. Path traversal here functions as reconnaissance, converting uncertain template influence into actionable RCE paths.
Assess your exposure by determining whether untrusted input ever reaches include/extend filenames. If so, implement containment validation (resolve and verify the result stays within an expected root) before passing filenames to the template engine. The low EPSS of 0.00372 likely reflects uncertainty about both exploitability preconditions and whether the library is actively maintained enough to deliver a patch.