CVE-2026-55760

Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.5.2

Description Applications that pass user-controlled input to the Handlebars.compile() function using a FileTemplateLoader or ClassPathTemplateLoader are susceptible to arbitrary file read. This occurs when web applications utilize template names sourced from URL path parameters, request parameters, or other user-controlled inputs, allowing for path traversal.

Recommendations Update to version 4.5.2. Validate that the template name is not derived from user input or implement a check to ensure the file path starts with the expected canonical path to prevent path traversal.