CVE-2026-71215 is a path traversal vulnerability in the art-template Node.js templating engine. The flaw exists in src/compile/adapter/resolve-filename.js, which resolves sub-template file paths using path.resolve(root, filename) without validating that the resolved path remains within the designated root directory. Because path.resolve() ignores the root when an absolute path is supplied and does not block '../' sequences, an attacker can supply a crafted filename to escape the root directory. The resolved path is passed directly to fs.readFileSync() in loader.js, causing arbitrary file contents to be read and rendered. This is exploitable when user-controlled input (e.g., a query parameter) is passed into template directives such as {{include page}} or extend(). Any Node.js application using art-template that exposes sub-template names to external input is at risk. Exploitation can lead to unauthorized disclosure of sensitive files accessible by the Node.js process.