Handlebars Java
Monthly
Unauthenticated file read in Handlebars.java's Spring MVC integration module (all versions prior to 4.5.3) allows remote attackers to retrieve arbitrary files accessible to the JVM process. The HandlebarsViewResolver passes attacker-controlled view names to handlebars.compile() without path-containment validation, and a file: or classpath: URL with a trailing # fragment delimiter causes the appended .hbs suffix to be silently discarded during resource resolution, bypassing the intended extension check. No active exploitation is confirmed (no CISA KEV listing) and no public POC has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects meaningful risk for any deployment with user-influenced view name routing.
Unauthenticated file read in Handlebars.java's Spring MVC integration module (all versions prior to 4.5.3) allows remote attackers to retrieve arbitrary files accessible to the JVM process. The HandlebarsViewResolver passes attacker-controlled view names to handlebars.compile() without path-containment validation, and a file: or classpath: URL with a trailing # fragment delimiter causes the appended .hbs suffix to be silently discarded during resource resolution, bypassing the intended extension check. No active exploitation is confirmed (no CISA KEV listing) and no public POC has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects meaningful risk for any deployment with user-influenced view name routing.