CVE-2026-103088
HighCVSS 7.5Summary
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment, reading files outside the configured template base directory.
Risk Assessment
The vulnerability allows reading arbitrary files outside the template directory, potentially leading to sensitive data leakage. It requires a Spring MVC application with specific configuration.
Recommendation
Update Handlebars.java to version 4.5.5 or later. Review template configuration and avoid using view names derived directly from requests.
Other vulnerabilities in Handlebars.java
See all- CVE-2026-63490High
Handlebars.java before version 4.5.3 contains a file read vulnerability. SpringTemplateLoader does not properly validate view names, allowing a remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. Fixed in version 4.5.3.
- CVE-2026-55760High
A path traversal vulnerability in Handlebars.java allows arbitrary file read. Applications passing user-controlled input to Handlebars.compile() with FileTemplateLoader or ClassPathTemplateLoader are affected.
Original NVD description (English source)
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS