CVE-2026-63490

Name of the Vulnerable Software and Affected Versions Handlebars.java versions prior to 4.5.3

Description The com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves Spring MVC view names through Spring ResourceLoader without path-containment validation. An unauthenticated remote attacker can exploit this when an application exposes a controller with a user-influenced view name. By using a view name with a file: or classpath: URL ending with a # fragment delimiter, the appended .hbs suffix is placed in the fragment and discarded by FileUrlResource.exists() and URL.openStream(). Subsequently, HandlebarsViewResolver passes the attacker-controlled name to the handlebars.compile() function, enabling the reading of files accessible to the JVM.

Recommendations Update to version 4.5.3.