CVE-2026-63490
Received Received - Intake

Path Traversal in Handlebars.java via Spring MVC View Names

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63490
EUVD
EUVD-2026-63392

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
com.github.jknack handlebars.java to 4.5.3 (exc)
com.github.jknack handlebars.java 4.5.3
com.github.jknack handlebars.springmvc to 4.5.2 (inc)
com.github.jknack handlebars 4.5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63490 is a high-severity vulnerability in the handlebars-springmvc library affecting versions up to 4.5.2. It allows unauthenticated arbitrary file read attacks due to a security bypass in the SpringTemplateLoader class. The issue occurs because SpringTemplateLoader fails to validate file paths properly when resolving view names in Spring MVC applications. Attackers can exploit this by including a URL fragment (#) in a view name, causing the .hbs suffix to be treated as part of the fragment rather than the file path. Since URL fragments are ignored by Spring's FileUrlResource and JDK's URL.openStream, attackers can read arbitrary files accessible to the JVM process.

Detection Guidance

To detect this vulnerability, check if your system uses handlebars-springmvc library versions up to 4.5.2. Inspect dependency files like pom.xml for com.github.jknack:handlebars-springmvc. Verify if SpringTemplateLoader is used in your Spring MVC application. Test for file read attempts by sending crafted view names with file: or classpath: URLs and # fragments to endpoints returning user-controlled view names.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to read sensitive files on the server, such as configuration files, credentials, private keys, or source code. Attackers could access files like application.yml, AWS/GCP credentials, Kubernetes tokens, or database configurations. This could lead to further attacks like JWT forgery, database access, infrastructure compromise, or lateral movement in cloud environments. Exploitation requires only a single unauthenticated HTTP request to a vulnerable controller.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, leading to regulatory fines, legal liabilities, and reputational damage. Organizations must patch this vulnerability to maintain compliance.

Mitigation Strategies

Immediately upgrade to handlebars.java version 4.5.3 or later. If upgrading is not possible, implement input validation to reject view names containing file:, classpath:, :, #, or .. characters. Add path-containment checks in SpringTemplateLoader similar to other template loaders. Review all controllers using user-controlled view names for potential exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart