CVE-2026-63490

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

• CWE-22
• CWE-23
• CWE-552

• https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5
• https://github.com/jknack/handlebars.java/releases/tag/v4.5.3
• https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w
• https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w

Published

Aug 20, 2026

Last Modified

Oct 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63478isomorphic-git is a pure JavaScript implementation of Git fo…5.3
• CVE-2026-6348WinMatrix agent developed by Simopro Technology has a Missin…8.8
• CVE-2026-63481Hurl is a command line tool that runs and tests HTTP request…6.9
• CVE-2026-63482Yeti bridges the gap between CTI and DFIR practitioners by p…7.5
• CVE-2026-63489Yeti bridges the gap between CTI and DFIR practitioners by p…7.6
• CVE-2026-6349The  iSherlock developed by HGiga  has an OS Command Injecti…9.8
• CVE-2026-63492Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-63493Snipe-IT is an IT asset/license management system. Prior to …8.1
• CVE-2026-63494Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-63495Libevent is an event notification library. From 2.2.0-alpha-…7.5
• CVE-2026-63498Snipe-IT is an IT asset/license management system. Prior to …5.4
• CVE-2026-63499zt-zip is a Java library that provides convenience methods f…6.9