CVE-2026-103088: High severity maven/com.github.jknack/handlebars-springmvc vulnerability
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
handlebars-springmvcto a version that resolves this vulnerability.Fixed in 4.5.5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected scenario is a Spring MVC application using handlebars-springmvc 4.5.3 or 4.5.4 with a file: template prefix and a view name derived from the request. Applications that do not combine those conditions are not identified as exposed by the provided information.
What does an attacker need to exploit it?
An attacker needs to be able to influence the view name used by the Spring MVC application. They can use a percent-encoded traversal sequence such as %2e%2e/ to escape the configured template base directory and read files.
Is authentication or user interaction required?
No. The supplied vector lists PR:N and UI:N, indicating that exploitation requires neither privileges nor user interaction.
What version addresses the issue?
Handlebars.java 4.5.5 addresses the issue. The described vulnerable handlebars-springmvc versions are 4.5.3 and 4.5.4.