Handlebars Java
Monthly
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
Unauthenticated file read in Handlebars.java's Spring MVC integration module (all versions prior to 4.5.3) allows remote attackers to retrieve arbitrary files accessible to the JVM process. The HandlebarsViewResolver passes attacker-controlled view names to handlebars.compile() without path-containment validation, and a file: or classpath: URL with a trailing # fragment delimiter causes the appended .hbs suffix to be silently discarded during resource resolution, bypassing the intended extension check. No active exploitation is confirmed (no CISA KEV listing) and no public POC has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects meaningful risk for any deployment with user-influenced view name routing.
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
Unauthenticated file read in Handlebars.java's Spring MVC integration module (all versions prior to 4.5.3) allows remote attackers to retrieve arbitrary files accessible to the JVM process. The HandlebarsViewResolver passes attacker-controlled view names to handlebars.compile() without path-containment validation, and a file: or classpath: URL with a trailing # fragment delimiter causes the appended .hbs suffix to be silently discarded during resource resolution, bypassing the intended extension check. No active exploitation is confirmed (no CISA KEV listing) and no public POC has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects meaningful risk for any deployment with user-influenced view name routing.