{"id":"CVE-2026-63490","summary":"Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass","details":"Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.","aliases":["GHSA-g29j-rwfv-h99w"],"modified":"2026-08-22T09:15:44.393441Z","published":"2026-08-20T14:45:35.727Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-23","CWE-552"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63490.json"},"references":[{"type":"WEB","url":"https://github.com/jknack/handlebars.java/releases/tag/v4.5.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63490.json"},{"type":"ADVISORY","url":"https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63490"},{"type":"FIX","url":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jknack/handlebars.java","events":[{"introduced":"0"},{"fixed":"61f43423a337b87db5fec1fe59f0725aaaa38df5"},{"fixed":"a733ae1e2b3b24d3857bd4cfff080130d777bdc7"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.5.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.5.1","v4.4.0","v4.3.1","v4.3.0","v4.2.1","v4.2.0","v4.1.2","v4.1.1","v4.1.0","v4.0.7","v4.0.6","v4.0.5","v4.0.0","v2.3.2","v2.3.1","v2.2.3","v2.2.2","v2.2.1","v2.2.0","v2.1.0","v2.0.0","v1.3.2","v1.3.1","v1.3.0","v1.2.1","v1.2.0","v1.1.2","v1.1.1","v1.1.0","v1.0.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","handlebars.java-0.7.0","handlebars.java-0.6.2","handlebars.java-0.6.1","handlebars.java-0.5.5","handlebars.java-0.5.4","handlebars.java-0.5.3","handlebars.java-0.5.0","handlebars.java-0.4.2","handlebars.java-0.4.1","handlebars.java-0.4.0","handlebars.java-0.3.1","handlebars.java-0.3.0","handlebars.java-0.2.2","handlebars.java-0.2.1","0.2.0","handlebars.java-0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63490.json","vanir_signatures_modified":"2026-08-22T09:15:44Z","vanir_signatures":[{"digest":{"function_hash":"189048322001925782931546065861680160374","length":417},"id":"CVE-2026-63490-03aeaaba","signature_type":"Function","signature_version":"v1","source":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5","target":{"file":"handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java","function":"resolve"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["283111640158751887371919179514456608793","124424237208915413044693078024977295718","128580819486392187617489657236963461290","306044615348563623402137061147643785484","110112269328007236743157190840262126045","21767270511925541131599885177307795758","2367167767513552376843969103825007714","242541466008822052188930733002140932551","173784460195689882239969544961718280505","267174442745707036181733078993054549113","125129305266544762237682132517201620426","125447234951807086833307985166096436024","303068627718475250610380021975769498734","240463503037576781791468056994744625573","21767270511925541131599885177307795758","2367167767513552376843969103825007714","242541466008822052188930733002140932551","34759626407033902026278371536171684098","24981344039524995588204155665602596450","127517712127678984621956449642277012655","15489294027092540617659836874620090305"],"threshold":0.9},"id":"CVE-2026-63490-12e16e6b","signature_type":"Line","signature_version":"v1","source":"https://github.com/jknack/handlebars.java/commit/a733ae1e2b3b24d3857bd4cfff080130d777bdc7","target":{"file":"handlebars-springmvc/src/test/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoaderTest.java"}},{"target":{"file":"handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java"},"deprecated":false,"digest":{"line_hashes":["183761468201175679659138099181099908101","147742068214475995042888476304373649123","307163843331844970840244863110920486337","166257965537882788533880066300401982794","125483172516086890838847213705728220762","61216548176903800072082083836046748128","215103592913422223645852145898212954170","23514186417129480334461058235179083014","192399087117178078317423398901048719982","37171824728493136345900589085831748430","121530667960709232256712015912021662934","114387268346263237604857219276877637100"],"threshold":0.9},"id":"CVE-2026-63490-4e96e63e","signature_type":"Line","signature_version":"v1","source":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5","target":{"file":"handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["12556972397938876904262034594577397291","219030385066092940297697232469012820824","201459153815000720943643615827038433505","319807086485784421064917754111117292777","146765013496801918948084321763651218358","131684101238753803528354566851700515142","261494752999438911161191518973037031666","333871743910750682037289186890679024664","265563099809951125418658445545367336846","118557139800153660604301681569365497462","53807451814544539454734025332506617865","137294189825524959186783112390604501074","339858015650258881245931771894059538084","190797721656681291192142442993826322740","329960580452948942597166270106893638408","157952907195093260627707880009985355213","223012828820754501401211258231179498115","175718475126074852069558602250908340022","90748865064192573537917112872207306375","241253817615965569380395524864509925754","300695396556594455707671855041016823476","291696659561503734385355836663253155767","263409651879307176551943944110824168418","63974683328277093447878508410438699560","61947625098248431834370035023104925425"]},"id":"CVE-2026-63490-8c1c31bd"},{"digest":{"line_hashes":["149844313103849893858802180184800941289","265347308949425364589233001227435863470","148602551397198423961953724310758317697","236211497381344135076818836342754370936","168607626548157139347622499053533330307","321287582264850149415897288521133349532","118176058011357964328556096815843335314","185169329738221927801130623088258653381","169743638174200832954260316650799559434","307400370564346550457095523569628875493"],"threshold":0.9},"id":"CVE-2026-63490-d5b7d430","signature_type":"Line","signature_version":"v1","source":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5","target":{"file":"handlebars-springmvc/src/test/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoaderTest.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5","target":{"file":"handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java","function":"configure"},"deprecated":false,"digest":{"function_hash":"164545399337510588322203006457352974054","length":466},"id":"CVE-2026-63490-df192c78","signature_type":"Function"},{"target":{"file":"handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java","function":"getResource"},"deprecated":false,"digest":{"function_hash":"304757198551881287477573073228682313543","length":175},"id":"CVE-2026-63490-e497d7d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}