What is the CVSS score of CVE-2026-55760?

CVE-2026-55760 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of handlebars.java are affected by CVE-2026-55760?

A file read vulnerability in jknack handlebars.java (versions prior to 4.5.2) allows unauthenticated attackers to access files outside designated template directories through path traversal,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55760?

Yes, a public proof-of-concept exploit is available for CVE-2026-55760. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-55760?

Within 24 hours: Inventory all applications and services using jknack handlebars.java and identify which versions are deployed. Within 7 days: Prepare upgrade to handlebars.java version 4.5.2 and test in staging environment, prioritizing systems that process untrusted template input. Within 30 days: Complete deployment of version 4.5.2 to all production systems.

handlebars.java CVE-2026-55760

EUVD-2026-42352 HIGH

Path Traversal (CWE-22)

2026-06-17 https://github.com/jknack/handlebars.java

GHSA-r4gv-qr8j-p3pg

Path Traversal Java Suse

7.5

CVSS 3.1 · Vendor: https://github.com/jknack/handlebars.java

Severity by source

Vendor (https://github.com/jknack/handlebars.java) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable template parameter, no auth or interaction, trivial ../ payload; arbitrary file read yields high confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (https://github.com/jknack/handlebars.java).

CVSS VectorVendor: https://github.com/jknack/handlebars.java

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 01:38 vuln.today

Analysis Generated

Jun 18, 2026 - 01:38 vuln.today

CVE Published

Jun 17, 2026 - 18:42 github-advisory

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

33 maven packages depend on com.github.jknack:handlebars (17 direct, 16 indirect)

Ecosystem-wide dependent count for version 4.5.2.

DescriptionCVE.org

Impact

Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.

Patches

com.github.jknack:handlebars:4.5.2

Workarounds

Validate template name is derived from user input.

java

if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) {
        throw new IOException("Path traversal attempt detected: " + location);
}

Articles & Coverage 1

News 5 New Java Vulnerabilities - 2 Critical, 3 High Severity Jun 18, 2026

AnalysisAI

Arbitrary file read in jknack handlebars.java versions prior to 4.5.2 allows remote unauthenticated attackers to retrieve files outside the intended template directory when applications pass user-controlled input to Handlebars.compile() with a FileTemplateLoader or ClassPathTemplateLoader. The flaw stems from missing path canonicalization in the template loaders, enabling classic ../ traversal sequences to escape the configured template prefix. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-r4gv-qr8j-p3pg documents the issue and the fix is available in 4.5.2.

Technical ContextAI

handlebars.java is a Java port of the Handlebars.js logic-less templating engine, distributed as the Maven artifact com.github.jknack:handlebars (pkg:maven/com.github.jknack:handlebars per CPE data). Templates are resolved via TemplateLoader implementations; FileTemplateLoader resolves names against a filesystem prefix directory and ClassPathTemplateLoader resolves them against the classpath. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the loaders concatenate the prefix with a caller-supplied template name without verifying that the resulting canonical path remains under the prefix, so embedded ../ segments traverse out of the template root and read arbitrary files the JVM process can access.

RemediationAI

Vendor-released patch: com.github.jknack:handlebars 4.5.2 - upgrade the Maven dependency to 4.5.2 or later as the primary fix, per GHSA-r4gv-qr8j-p3pg (https://github.com/jknack/handlebars.java/security/advisories/GHSA-r4gv-qr8j-p3pg). If an immediate upgrade is not possible, apply the workaround documented in the advisory by validating that the resolved template file's canonical path starts with the canonical path of the configured prefix (for example, throw an IOException when file.getPath() does not begin with new File(prefix).getCanonicalPath()), which blocks ../ traversal at the cost of rejecting any legitimately symlinked template trees. As a complementary control, refactor callers so that template names supplied by users are mapped through a strict allowlist or enum rather than passed directly into Handlebars.compile(); this eliminates the attack surface entirely but requires code changes in every endpoint that selects templates dynamically.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

CVE-2022-37042 CRITICAL POC

9.8

CVE-2022-30333 HIGH POC

7.5

Same technique Path Traversal

View all

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

CVE-2022-30333 HIGH POC

7.5

CVE-2022-27925 HIGH POC

7.2

CVE-2023-47246 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2024-41713 CRITICAL POC

9.1

CVE-2016-0752 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected

CVE-2026-55760 vulnerability details – vuln.today

Back

handlebars.java CVE-2026-55760

Severity by source

CVSS VectorVendor: https://github.com/jknack/handlebars.java

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

Impact

Patches

Workarounds

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code