CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.

• CWE-24

• https://github.com/jknack/handlebars.java/commit/f6ae3979917d05bef07f00befb4013ef00503660
• https://github.com/jknack/handlebars.java/releases/tag/v4.5.5
• https://github.com/jknack/handlebars.java/security/advisories/GHSA-pvrx-3g7m-fpgv
• https://github.com/jknack/handlebars.java/security/advisories/GHSA-pvrx-3g7m-fpgv

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103063Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-103064Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-103067Cross-Site Request Forgery (CSRF) vulnerability in Memberful…8
• CVE-2026-103068Subscriber Privilege Escalation in ByteCoreStack – MCP…8.8
• CVE-2026-103082Server-Side Request Forgery (SSRF) vulnerability in LA-Studi…7.2
• CVE-2026-103087Uncontrolled recursion in the Gosub browser engine (gosub-en…7.1
• CVE-2026-103099Pexip Infinity before 41.1 is affected by improper input val…7.5
• CVE-2026-1031IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.1
• CVE-2026-103100Pexip Infinity before 40.1 is affected by improper input val…7.5
• CVE-2026-103101Pexip Infinity 30.0 through 40.x before 41.0 is affected by …8.6
• CVE-2026-103102Pexip Infinity before 41.0 is affected by improper input val…8.6
• CVE-2026-103104Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is aff…7.5