diff -r 99e8a9ff1f5f -r f77a3f27cea5 mercurial/hgweb/hgweb_mod.py
--- a/mercurial/hgweb/hgweb_mod.py	Mon Aug 31 22:44:20 2015 -0400
+++ b/mercurial/hgweb/hgweb_mod.py	Tue Sep 01 17:09:00 2015 -0500
@@ -159,9 +159,10 @@
         self.repostate = ((-1, -1), (-1, -1))
         self.mtime = -1
         self.reponame = name
-        # a repo owner may set web.templates in .hg/hgrc to get any file
-        # readable by the user running the CGI script
-        self.templatepath = self.config('web', 'templates')
+        # we use untrusted=False to prevent a repo owner from using
+        # web.templates in .hg/hgrc to get access to any file readable
+        # by the user running the CGI script
+        self.templatepath = self.config('web', 'templates', untrusted=False)
         self.websubtable = self.loadwebsub()
 
     # The CGI scripts are often run by a user different from the repo owner.