CVE-2026-63490: Path Traversal and Arbitrary File Disclosure in Handlebars.java
Vulnerability ID: CVE-2026-63490
CVSS Score: 7.5
Published: 2026-09-02
CVE-2026-63490 is a critical path traversal vulnerability in the Spring MVC integration of Handlebars.java. It allows unauthenticated remote attackers to bypass suffix validation and retrieve arbitrary system files via crafted dynamic view names.
TL;DR
Unauthenticated path traversal in Handlebars.java allows arbitrary file retrieval by exploiting a parser discrepancy between Java's URL resolver and template suffix enforcement.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22, CWE-23, CWE-552
- Attack Vector: Network
- CVSS v3.1 Score: 7.5 (High)
- EPSS Score: 0.0047
- Impact: Arbitrary File Disclosure
- Exploit Status: Proof of Concept
- KEV Status: Not Listed
Affected Systems
- Applications implementing handlebars-springmvc below version 4.5.3
-
handlebars-springmvc: < 4.5.3 (Fixed in:
4.5.3)
Code Analysis
Commit: 61f4342
Enforce boundary checks and validate URL fragments/queries during resource resolution in SpringTemplateLoader and HandlebarsViewResolver
Exploit Details
- GitHub: Advisory containing PoC steps and details of the path traversal suffix bypass mechanism.
Mitigation Strategies
- Upgrade Handlebars.java dependency to version 4.5.3 or later
- Refactor controller logic to avoid direct user influence on MVC view names
- Implement strong input filtering for URL protocols and URL delimiters in controller paths
Remediation Steps:
- Open the build configuration file (pom.xml or build.gradle).
- Locate the dependency for com.github.jknack:handlebars-springmvc.
- Update the version string to 4.5.3.
- Rebuild and deploy the application.
- Ensure view names returned by controllers are resolved against a static, validated list of templates.
References
Read the full report for CVE-2026-63490 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)