handlebars.java CVE-2026-55760
HIGH
GHSA-r4gv-qr8j-p3pg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable template parameter, no auth or interaction, trivial ../ payload; arbitrary file read yields high confidentiality impact with no integrity or availability effect.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.
Patches
com.github.jknack:handlebars:4.5.2
Workarounds
Validate template name is derived from user input.
if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) {
throw new IOException("Path traversal attempt detected: " + location);
}Articles & Coverage 1
AnalysisAI
Arbitrary file read in jknack handlebars.java versions prior to 4.5.2 allows remote unauthenticated attackers to retrieve files outside the intended template directory when applications pass user-controlled input to Handlebars.compile() with a FileTemplateLoader or ClassPathTemplateLoader. The flaw stems from missing path canonicalization in the template loaders, enabling classic ../ traversal sequences to escape the configured template prefix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application (a) embeds com.github.jknack:handlebars at a version below 4.5.2, (b) instantiates a FileTemplateLoader or ClassPathTemplateLoader, and (c) passes attacker-controllable data - typically a URL path segment, query parameter, form field, or header value - as the template name argument to Handlebars.compile(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects unauthenticated network exploitation with low complexity and a confidentiality-only impact, which matches an arbitrary file read primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A web application exposes an endpoint such as /render?template=welcome that forwards the template parameter into Handlebars.compile() backed by a FileTemplateLoader rooted at /opt/app/templates. An unauthenticated attacker sends /render?template=../../../../etc/passwd (or a classpath equivalent like ../../../../application.properties), causing the loader to read and return the targeted file as template content, disclosing credentials, configuration, or source code; no public PoC is referenced in the advisory but the technique follows standard CWE-22 patterns and the CVSS AC:L/PR:N/UI:N vector confirms the path is trivially reachable. |
| Remediation | Vendor-released patch: com.github.jknack:handlebars 4.5.2 - upgrade the Maven dependency to 4.5.2 or later as the primary fix, per GHSA-r4gv-qr8j-p3pg (https://github.com/jknack/handlebars.java/security/advisories/GHSA-r4gv-qr8j-p3pg). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all applications and services using jknack handlebars.java and identify which versions are deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.tran
NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers t
Origin validation failure in Spring Cloud Gateway (WebMVC and WebFlux Server variants) allows remote attackers to spoof
Denial-of-service in Spring Cloud Sleuth 3.1.0 through 3.1.13 allows remote unauthenticated attackers to exhaust applica
Denial of service in Steeltoe.Discovery.Eureka client (.NET) versions prior to 4.2.0 and 3.4.0 allows a remote Eureka re
Share
External POC / Exploit Code
Leaving vuln.today