WordPress Core is vulnerable to Path Traversal via the _get_block_template_file() function used by the REST templates controller (/wp/v2/templates/<id>?source=theme) in various versions up to, and including, 7.1 due to the template slug being resolved into a file path without directory containment. Because the route regex forbids '.' but the sanitize callback urldecodes twice, a double-encoded traversal reaches file resolution. This makes it possible for authenticated attackers with Contributor-level access and above to read arbitrary .html files outside the theme template directory.