Skip to main content

handlebars.java EUVDEUVD-2026-42352

| CVE-2026-55760 HIGH
Path Traversal (CWE-22)
2026-06-17 https://github.com/jknack/handlebars.java GHSA-r4gv-qr8j-p3pg
Path Traversal Java Suse
7.5
CVSS 3.1 · Vendor: https://github.com/jknack/handlebars.java
Share

Severity by source

Vendor (https://github.com/jknack/handlebars.java) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
7.5 HIGH

Network-reachable template parameter, no auth or interaction, trivial ../ payload; arbitrary file read yields high confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (https://github.com/jknack/handlebars.java).

CVSS VectorVendor: https://github.com/jknack/handlebars.java

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 18, 2026 - 01:38 vuln.today
Analysis Generated
Jun 18, 2026 - 01:38 vuln.today
CVE Published
Jun 17, 2026 - 18:42 github-advisory
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 33 maven packages depend on com.github.jknack:handlebars (17 direct, 16 indirect)

Ecosystem-wide dependent count for version 4.5.2.

DescriptionCVE.org

Impact

Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.

Patches

com.github.jknack:handlebars:4.5.2

Workarounds

Validate template name is derived from user input.

java
if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) {
        throw new IOException("Path traversal attempt detected: " + location);
}

Articles & Coverage 1

News 5 New Java Vulnerabilities - 2 Critical, 3 High Severity Jun 18, 2026

AnalysisAI

Arbitrary file read in jknack handlebars.java versions prior to 4.5.2 allows remote unauthenticated attackers to retrieve files outside the intended template directory when applications pass user-controlled input to Handlebars.compile() with a FileTemplateLoader or ClassPathTemplateLoader. The flaw stems from missing path canonicalization in the template loaders, enabling classic ../ traversal sequences to escape the configured template prefix. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-r4gv-qr8j-p3pg documents the issue and the fix is available in 4.5.2.

Technical ContextAI

handlebars.java is a Java port of the Handlebars.js logic-less templating engine, distributed as the Maven artifact com.github.jknack:handlebars (pkg:maven/com.github.jknack:handlebars per CPE data). Templates are resolved via TemplateLoader implementations; FileTemplateLoader resolves names against a filesystem prefix directory and ClassPathTemplateLoader resolves them against the classpath. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the loaders concatenate the prefix with a caller-supplied template name without verifying that the resulting canonical path remains under the prefix, so embedded ../ segments traverse out of the template root and read arbitrary files the JVM process can access.

RemediationAI

Vendor-released patch: com.github.jknack:handlebars 4.5.2 - upgrade the Maven dependency to 4.5.2 or later as the primary fix, per GHSA-r4gv-qr8j-p3pg (https://github.com/jknack/handlebars.java/security/advisories/GHSA-r4gv-qr8j-p3pg). If an immediate upgrade is not possible, apply the workaround documented in the advisory by validating that the resolved template file's canonical path starts with the canonical path of the configured prefix (for example, throw an IOException when file.getPath() does not begin with new File(prefix).getCanonicalPath()), which blocks ../ traversal at the cost of rejecting any legitimately symlinked template trees. As a complementary control, refactor callers so that template names supplied by users are mapped through a strict allowlist or enum rather than passed directly into Handlebars.compile(); this eliminates the attack surface entirely but requires code changes in every endpoint that selects templates dynamically.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Same technique Path Traversal

View all
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5
CVE-2022-27925 HIGH POC
7.2
CVE-2023-47246 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2024-41713 CRITICAL POC
9.1
CVE-2016-0752 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected

Share

EUVD-2026-42352 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy