Handlebars.java bug can let attackers read server files

Published September 2, 2026 CVE-2026-63490

A bug in the Handlebars.java template engine lets an outside attacker read files off a web app's server without logging in. It affects Spring MVC sites that use Handlebars to build web pages and let page names come from user input.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 4.5.3Fix recorded on Sep 2, 2026
Affected versions
before 4.5.3
Weakness
CWE-22Path Traversal
Exploit likelihood
0.47% in 30 daysEPSS, higher than 39% of known flaws
Affects
Handlebars.java+2 more

How it works

A page-name value ending in a hash symbol tricks the loader into opening the exact file path instead of the safely restricted template file, so the app reads and displays whatever file the attacker names.

What to do

Check which version of the com.github.jknack handlebars-springmvc Maven package your Spring MVC application depends, and check whether any controller passes user input into the view name it hands to HandlebarsViewResolver. Update to handlebars-springmvc 4.5.3 or later, where this path-check bypass is fixed.

Update the com.github.jknack:handlebars-springmvc dependency to version 4.5.3 or later and redeploy, since 4.5.3 restores the same path-containment check the other loaders already have.

Technical details

Affected software: Handlebars.java, handlebars-springmvc, com.github.jknack

SpringTemplateLoader resolves Spring MVC view names into resources through Spring's ResourceLoader without the path-containment check applied to handlebars.java's other URL-based loaders (ClassPathTemplateLoader, FileTemplateLoader, ServletContextTemplateLoader), which were hardened in commit d177cdee. The only remaining protection for file: or classpath: view names was the.hbs suffix AbstractTemplateLoader appends. Ending the view name with a fragment delimiter places that suffix inside the URL fragment, which both Spring's FileUrlResource.exists and the JDK's URL.openStream silently discard, so the literal attacker-specified path is opened, compiled, and rendered. Fixed in 4.5.3.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source