What is the CVSS score of CVE-2026-103088?

CVE-2026-103088 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Handlebars.java are affected by CVE-2026-103088?

A directory traversal flaw in the Handlebars.java templating engine, shipped through the handlebars-springmvc integration in versions 4.5.3 and 4.5.4, could let an external party read files outside…. A patch is available.

How to fix or mitigate CVE-2026-103088?

Within 24 hours, inventory every application and service that depends on handlebars-springmvc 4.5.3 or 4.5.4, or any Handlebars.java build below 4.5.5, using software composition analysis or a dependency manifest scan; for each hit, determine whether it configures a file: template location prefix and whether Handlebars view names can be influenced by request input, and where both conditions hold, immediately remove the file: prefix in favor of a classpath-based template root or hard-code a fixed template name so no request-controlled string reaches the view resolver. Within 7 days, add a controller- or filter-layer allow-list of permitted template names, reject any request parameter containing percent-encoded traversal sequences such as %2e%2e, %2f, or %5c before it reaches Handlebars, and confirm that any existing containment check operates on the fully percent-decoded canonical path rather than the raw encoded string; note that the 4.5.3 and 4.5.4 path-containment logic added for CVE-2026-63490 compared encoded paths while the file was ultimately opened through a URL handler that decodes them, which is exactly the gap to close. Within 30 days, monitor the Handlebars.java project for the 4.5.5 release referenced in the advisory and upgrade to 4.5.5 or later the moment it is published, sweeping every dependent service and stamping the change into build pipelines; where the library is forked, shaded, or otherwise cannot be replaced quickly, run the affected application under a least-privilege service account whose filesystem read access is limited to the directories it legitimately needs, and add log-based alerting for anomalous template parameter values so attempted exploitation is detected even though no public exploit code has been identified at time of analysis.

Handlebars.java CVE-2026-103088

EUVD-2026-89555 HIGH

Path Traversal: '../filedir' (CWE-24)

2026-09-30 mitre

GHSA-2m6h-5wp5-qp66

Java Path Traversal Spring Handlebars Java

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated encode/decode-mismatch traversal is low-complexity once the required file: prefix and request-derived view name are configured; impact is arbitrary file read only, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

POC Analysis Generated

Sep 30, 2026 - 11:21 vuln.today

Metadata Corrected

Sep 30, 2026 - 02:40 vuln.today

tag: Spring added

Patch available

Sep 30, 2026 - 02:01 EUVD

Analysis Generated

Sep 30, 2026 - 01:43 vuln.today

CVE Published

Sep 30, 2026 - 00:55 cve.org

HIGH 7.5

DescriptionCVE.org

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.

Articles & Coverage 1

News 14 New Java Vulnerabilities - 4 Critical, 10 High Severity Sep 30, 2026

AnalysisAI

Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a Spring MVC application using handlebars-springmvc 4.5.3 or 4.5.4 that (1) is configured with a file: template location prefix (rather than the classpath default) AND (2) derives the Handlebars view name from untrusted request input. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine, cleanly-defined vulnerability but its real-world priority is moderate and highly configuration-dependent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Handlebars.java 4.5.5 (https://github.com/jknack/handlebars.java/releases/tag/v4.5.5), which fixes the raw-versus-decoded containment mismatch; the corresponding upstream change is commit f6ae3979917d05bef07f00befb4013ef00503660 and the advisory is at https://github.com/jknack/handlebars.java/security/advisories/GHSA-pvrx-3g7m-fpgv. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every application and service that depends on handlebars-springmvc 4.5.3 or 4.5.4, or any Handlebars.java build below 4.5.5, using software composition analysis or a dependency manifest scan; for each hit, determine whether it configures a file: template location prefix and whether Handlebars view names can be influenced by request input, and where both conditions hold, immediately remove the file: prefix in favor of a classpath-based template root or hard-code a fixed template name so no request-controlled string reaches the view resolver. …

Threat intelligence, references, and detailed analysis are available after sign-in.