Vulnerability-Lookup

GHSA-G29J-RWFV-H99W

Vulnerability from github – Published: 2026-09-02 22:12 – Updated: 2026-09-02 22:12

Summary

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Details

Summary

com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves Spring MVC view names into URLs via Spring's ResourceLoader without applying the path-containment check that protects every other URL-based loader in the project (ClassPathTemplateLoader, FileTemplateLoader, ServletContextTemplateLoader - all hardened by commit d177cdee).

The only remaining defense for file: / classpath: view names is the unconditional .hbs suffix appended by AbstractTemplateLoader.resolve(...). This suffix is the load-bearing security boundary that prevents a request like view=file:/etc/passwd from reading /etc/passwd instead of /etc/passwd.hbs.

This boundary is bypassed by a single character: # (the URL fragment delimiter).

When the view name ends with #, the appended .hbs lands inside the URL fragment. Both Spring's FileUrlResource.exists() (via URI.getSchemeSpecificPart()) and the JDK's URL.openStream() (via URL.getFile()) silently discard the fragment, so the file actually opened is the bare path the attacker specified - for example /etc/passwd rather than /etc/passwd.hbs. The compiled "template" is then parsed and rendered into the HTTP response body.

Result: unauthenticated, network-reachable, arbitrary file read of any file readable by the JVM process on any Spring MVC application that uses a default-configured HandlebarsViewResolver and exposes a controller that returns a (fully or partly) user-influenced view name.

Vulnerable Code

`SpringTemplateLoader.resolve` - preserves `file:` / `classpath:` and applies suffix to the path portion

// handlebars-springmvc/.../SpringTemplateLoader.java:66-77
@Override
public String resolve(final String location) {
  String protocol = null;
  if (location.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {
    protocol = ResourceUtils.CLASSPATH_URL_PREFIX;
  } else if (location.startsWith(ResourceUtils.FILE_URL_PREFIX)) {
    protocol = ResourceUtils.FILE_URL_PREFIX;          // matches "file:"
  }
  if (protocol == null) {
    return super.resolve(location);
  }
  return protocol + super.resolve(location.substring(protocol.length()));
}

`SpringTemplateLoader.getResource` - no containment check

// handlebars-springmvc/.../SpringTemplateLoader.java:57-63
@Override
protected URL getResource(final String location) throws IOException {
  Resource resource = loader.getResource(location);   // trust Spring blindly
  if (!resource.exists()) {
    return null;
  }
  return resource.getURL();
}

Contrast with the hardened sibling ClassPathTemplateLoader.getResource, which delegates to URLTemplateLoader.classpathResource(...) - the containment helper added by commit d177cdee:

// handlebars/.../io/URLTemplateLoader.java:75-93   (the d177cdee hardening)
protected final String classpathResource(String location) {
  String resolvedPath =
      Paths.get(location).normalize().toString().replace(java.io.File.separatorChar, '/');
  if (location.startsWith("/") && !resolvedPath.startsWith("/")) {
    resolvedPath = "/" + resolvedPath;
  }
  String prefix = getPrefix();
  if (!prefix.equals("/") && !resolvedPath.startsWith(prefix)) {
    throw new IllegalArgumentException(
        "Path traversal attempt detected. Resolved path escapes base prefix: " + location);
  }
  return resolvedPath;
}

SpringTemplateLoader.getResource never calls this helper.

`HandlebarsViewResolver` - strips the outer prefix/suffix and forwards to compile, no validation

// handlebars-springmvc/.../HandlebarsViewResolver.java:112-117
public HandlebarsViewResolver(final Class<? extends HandlebarsView> viewClass) {
  setViewClass(viewClass);
  setContentType(DEFAULT_CONTENT_TYPE);
  setPrefix(TemplateLoader.DEFAULT_PREFIX);   // "/"
  setSuffix(TemplateLoader.DEFAULT_SUFFIX);   // ".hbs"
}

// handlebars-springmvc/.../HandlebarsViewResolver.java:163-178
protected AbstractUrlBasedView configure(final HandlebarsView view) throws IOException {
  String url = view.getUrl();
  url = url.substring(getPrefix().length(), url.length() - getSuffix().length());
  try {
    view.setTemplate(handlebars.compile(url));      // ← attacker-controlled url
    view.setValueResolver(valueResolvers.toArray(new ValueResolver[0]));
  } catch (IOException ex) {
    if (failOnMissingFile) throw ex;
    logger.debug("File not found: " + url);
  }
  return view;
}

`AbstractTemplateLoader.resolve` - the load-bearing `.hbs` gate

// handlebars/.../io/AbstractTemplateLoader.java:47-50
@Override
public String resolve(final String uri) {
  return prefix + normalize(uri) + suffix;   // "/" + path + ".hbs"
}

The suffix string is concatenated as a string. Whether that string lands in the path component, query component, or fragment component of the resulting URL is decided by Spring's URL parsing - not by Handlebars.

Impact

Direct primitive

Unauthenticated arbitrary file read of any file readable by the JVM process UID.

Real-world attack chains (downstream impact)

Read application.yml -> extract jwt.secret / spring.datasource.password -> forge admin JWT or directly connect to the database. Common Spring Boot deployment pattern; one request to game-over.
Read AWS / GCP credentials -> assume role -> exfiltrate buckets, modify infrastructure.
Read K8s service-account token -> API-server access scoped to the pod's role -> namespace lateral movement, secret exfiltration.
Read /proc/self/environ -> harvest CI/CD-injected secrets that never appear on disk.
Read private keys (id_rsa, TLS keys) -> impersonate host / decrypt MITM'd traffic / sign commits.
Read the application's source-code-on-disk to discover further server-side endpoints, hardcoded credentials, or chains.

Indirect

Confirmed reachable from any controller that returns user-influenced view names - a documented Spring anti-pattern that nevertheless appears in production (CMS preview endpoints, theme switchers, multi-tenant view routing, @RequestMapping("/{view}") patterns, DefaultRequestToViewNameTranslator-driven URL->view mappings).
No authentication, no privilege, no clicks - a single Internet HTTP GET.

Remediation

Any of the following independently closes the bypass. We recommend implementing #1 and #2 for defense in depth.

Apply the containment helper to `SpringTemplateLoader.getResource` (parity with d177cdee)

// handlebars-springmvc/.../SpringTemplateLoader.java
@Override
protected URL getResource(final String location) throws IOException {
  // For classpath: locations, delegate to the hardened helper as ClassPathTemplateLoader does.
  // For file: locations, perform an explicit canonical-path containment check.
  Resource resource = loader.getResource(location);
  if (!resource.exists()) {
    return null;
  }
  URL url = resource.getURL();
  validateNoUnsafeUrlComponents(url);   // see 9.3
  return url;
}

Validate the resolved URL components

private static void validateNoUnsafeUrlComponents(URL url) {
  if (url.getRef() != null) {
    throw new IllegalArgumentException(
        "Template URL must not contain a fragment: " + url);
  }
  if (url.getQuery() != null) {
    throw new IllegalArgumentException(
        "Template URL must not contain a query: " + url);
  }
}

This is the structural fix - it ensures the textual .hbs check matches the resolved-file behavior regardless of input shape.

Remove the protocol short-circuit entirely

If the supported deployment model is "templates live in one well-known prefix", SpringTemplateLoader.resolve should not preserve file: / classpath: prefixes from user input at all. Either remove that branch, or require an explicit allow-list in the constructor:

public SpringTemplateLoader(ResourceLoader loader, boolean allowProtocolPrefixes) { ... }

with the default being false.

Validate the stripped view name in `HandlebarsViewResolver.configure`

// handlebars-springmvc/.../HandlebarsViewResolver.java:163-178
protected AbstractUrlBasedView configure(final HandlebarsView view) throws IOException {
  String url = view.getUrl();
  url = url.substring(getPrefix().length(), url.length() - getSuffix().length());
  if (url.contains(":") || url.contains("#") || url.contains("..")) {
    throw new IllegalArgumentException("Unsafe view name: " + url);
  }
  // ...
}

This is a defense-in-depth check that rejects view names containing protocols, fragments, or traversal sequences. It does not by itself remove the SpringTemplateLoader weakness (developers calling handlebars.compile(...) directly still bypass it), but it eliminates the most common reach pattern.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.github.jknack:handlebars-springmvc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23",
      "CWE-552"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T22:12:03Z",
    "nvd_published_at": "2026-08-20T15:18:04Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`com.github.jknack.handlebars.springmvc.SpringTemplateLoader` resolves Spring MVC view names into URLs via Spring\u0027s `ResourceLoader` **without applying the path-containment check** that protects every other URL-based loader in the project (`ClassPathTemplateLoader`, `FileTemplateLoader`, `ServletContextTemplateLoader` - all hardened by commit `d177cdee`).\n\nThe only remaining defense for `file:` / `classpath:` view names is the unconditional `.hbs` suffix appended by `AbstractTemplateLoader.resolve(...)`. This suffix is the load-bearing security boundary that prevents a request like `view=file:/etc/passwd` from reading `/etc/passwd` instead of `/etc/passwd.hbs`.\n\n**This boundary is bypassed by a single character: `#` (the URL fragment delimiter).**\n\nWhen the view name ends with `#`, the appended `.hbs` lands inside the URL fragment. Both Spring\u0027s `FileUrlResource.exists()` (via `URI.getSchemeSpecificPart()`) and the JDK\u0027s `URL.openStream()` (via `URL.getFile()`) **silently discard the fragment**, so the file actually opened is the bare path the attacker specified - for example `/etc/passwd` rather than `/etc/passwd.hbs`. The compiled \"template\" is then parsed and rendered into the HTTP response body.\n\nResult: **unauthenticated, network-reachable, arbitrary file read** of any file readable by the JVM process on any Spring MVC application that uses a default-configured `HandlebarsViewResolver` and exposes a controller that returns a (fully or partly) user-influenced view name.\n\n### Vulnerable Code\n\n#### `SpringTemplateLoader.resolve` - preserves `file:` / `classpath:` and applies suffix to the path portion\n\n```java\n// handlebars-springmvc/.../SpringTemplateLoader.java:66-77\n@Override\npublic String resolve(final String location) {\n  String protocol = null;\n  if (location.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {\n    protocol = ResourceUtils.CLASSPATH_URL_PREFIX;\n  } else if (location.startsWith(ResourceUtils.FILE_URL_PREFIX)) {\n    protocol = ResourceUtils.FILE_URL_PREFIX;          // matches \"file:\"\n  }\n  if (protocol == null) {\n    return super.resolve(location);\n  }\n  return protocol + super.resolve(location.substring(protocol.length()));\n}\n```\n\n#### `SpringTemplateLoader.getResource` - **no containment check**\n\n```java\n// handlebars-springmvc/.../SpringTemplateLoader.java:57-63\n@Override\nprotected URL getResource(final String location) throws IOException {\n  Resource resource = loader.getResource(location);   // trust Spring blindly\n  if (!resource.exists()) {\n    return null;\n  }\n  return resource.getURL();\n}\n```\n\nContrast with the hardened sibling `ClassPathTemplateLoader.getResource`, which delegates to `URLTemplateLoader.classpathResource(...)` - the containment helper added by commit `d177cdee`:\n\n```java\n// handlebars/.../io/URLTemplateLoader.java:75-93   (the d177cdee hardening)\nprotected final String classpathResource(String location) {\n  String resolvedPath =\n      Paths.get(location).normalize().toString().replace(java.io.File.separatorChar, \u0027/\u0027);\n  if (location.startsWith(\"/\") \u0026\u0026 !resolvedPath.startsWith(\"/\")) {\n    resolvedPath = \"/\" + resolvedPath;\n  }\n  String prefix = getPrefix();\n  if (!prefix.equals(\"/\") \u0026\u0026 !resolvedPath.startsWith(prefix)) {\n    throw new IllegalArgumentException(\n        \"Path traversal attempt detected. Resolved path escapes base prefix: \" + location);\n  }\n  return resolvedPath;\n}\n```\n\n`SpringTemplateLoader.getResource` never calls this helper.\n\n#### `HandlebarsViewResolver` - strips the outer prefix/suffix and forwards to compile, no validation\n\n```java\n// handlebars-springmvc/.../HandlebarsViewResolver.java:112-117\npublic HandlebarsViewResolver(final Class\u003c? extends HandlebarsView\u003e viewClass) {\n  setViewClass(viewClass);\n  setContentType(DEFAULT_CONTENT_TYPE);\n  setPrefix(TemplateLoader.DEFAULT_PREFIX);   // \"/\"\n  setSuffix(TemplateLoader.DEFAULT_SUFFIX);   // \".hbs\"\n}\n\n// handlebars-springmvc/.../HandlebarsViewResolver.java:163-178\nprotected AbstractUrlBasedView configure(final HandlebarsView view) throws IOException {\n  String url = view.getUrl();\n  url = url.substring(getPrefix().length(), url.length() - getSuffix().length());\n  try {\n    view.setTemplate(handlebars.compile(url));      // \u2190 attacker-controlled url\n    view.setValueResolver(valueResolvers.toArray(new ValueResolver[0]));\n  } catch (IOException ex) {\n    if (failOnMissingFile) throw ex;\n    logger.debug(\"File not found: \" + url);\n  }\n  return view;\n}\n```\n\n#### `AbstractTemplateLoader.resolve` - the load-bearing `.hbs` gate\n\n```java\n// handlebars/.../io/AbstractTemplateLoader.java:47-50\n@Override\npublic String resolve(final String uri) {\n  return prefix + normalize(uri) + suffix;   // \"/\" + path + \".hbs\"\n}\n```\n\nThe suffix string is concatenated as a string. Whether that string lands in the path component, query component, or fragment component of the resulting URL is decided by Spring\u0027s URL parsing - not by Handlebars.\n\n### Impact\n\n#### Direct primitive\n\nUnauthenticated arbitrary file read of any file readable by the JVM process UID.\n\n#### Real-world attack chains (downstream impact)\n\n1. **Read `application.yml` -\u003e extract `jwt.secret` / `spring.datasource.password` -\u003e forge admin JWT or directly connect to the database.** Common Spring Boot deployment pattern; one request to game-over.\n2. **Read AWS / GCP credentials -\u003e assume role -\u003e exfiltrate buckets, modify infrastructure.**\n3. **Read K8s service-account token -\u003e API-server access scoped to the pod\u0027s role -\u003e namespace lateral movement, secret exfiltration.**\n4. **Read `/proc/self/environ` -\u003e harvest CI/CD-injected secrets that never appear on disk.**\n5. **Read private keys (`id_rsa`, TLS keys) -\u003e impersonate host / decrypt MITM\u0027d traffic / sign commits.**\n6. **Read the application\u0027s source-code-on-disk** to discover further server-side endpoints, hardcoded credentials, or chains.\n\n#### Indirect\n\n* Confirmed reachable from any controller that returns user-influenced view names - a documented Spring anti-pattern that nevertheless appears in production (CMS preview endpoints, theme switchers, multi-tenant view routing, `@RequestMapping(\"/{view}\")` patterns, `DefaultRequestToViewNameTranslator`-driven URL-\u003eview mappings).\n* No authentication, no privilege, no clicks - a single Internet HTTP GET.\n\n### Remediation\n\nAny of the following independently closes the bypass. We recommend implementing **#1 and #2** for defense in depth.\n\n#### Apply the containment helper to `SpringTemplateLoader.getResource` (parity with d177cdee)\n\n```java\n// handlebars-springmvc/.../SpringTemplateLoader.java\n@Override\nprotected URL getResource(final String location) throws IOException {\n  // For classpath: locations, delegate to the hardened helper as ClassPathTemplateLoader does.\n  // For file: locations, perform an explicit canonical-path containment check.\n  Resource resource = loader.getResource(location);\n  if (!resource.exists()) {\n    return null;\n  }\n  URL url = resource.getURL();\n  validateNoUnsafeUrlComponents(url);   // see 9.3\n  return url;\n}\n```\n\n#### Validate the resolved URL components\n\n```java\nprivate static void validateNoUnsafeUrlComponents(URL url) {\n  if (url.getRef() != null) {\n    throw new IllegalArgumentException(\n        \"Template URL must not contain a fragment: \" + url);\n  }\n  if (url.getQuery() != null) {\n    throw new IllegalArgumentException(\n        \"Template URL must not contain a query: \" + url);\n  }\n}\n```\n\nThis is the **structural** fix - it ensures the textual `.hbs` check matches the resolved-file behavior regardless of input shape.\n\n#### Remove the protocol short-circuit entirely\n\nIf the supported deployment model is \"templates live in one well-known prefix\", `SpringTemplateLoader.resolve` should not preserve `file:` / `classpath:` prefixes from user input at all. Either remove that branch, or require an explicit allow-list in the constructor:\n\n```java\npublic SpringTemplateLoader(ResourceLoader loader, boolean allowProtocolPrefixes) { ... }\n```\n\nwith the default being `false`.\n\n#### Validate the stripped view name in `HandlebarsViewResolver.configure`\n\n```java\n// handlebars-springmvc/.../HandlebarsViewResolver.java:163-178\nprotected AbstractUrlBasedView configure(final HandlebarsView view) throws IOException {\n  String url = view.getUrl();\n  url = url.substring(getPrefix().length(), url.length() - getSuffix().length());\n  if (url.contains(\":\") || url.contains(\"#\") || url.contains(\"..\")) {\n    throw new IllegalArgumentException(\"Unsafe view name: \" + url);\n  }\n  // ...\n}\n```\n\nThis is a defense-in-depth check that rejects view names containing protocols, fragments, or traversal sequences. It does not by itself remove the SpringTemplateLoader weakness (developers calling `handlebars.compile(...)` directly still bypass it), but it eliminates the most common reach pattern.",
  "id": "GHSA-g29j-rwfv-h99w",
  "modified": "2026-09-02T22:12:03Z",
  "published": "2026-09-02T22:12:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63490"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jknack/handlebars.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass"
}

CVE-2026-63490 (GCVE-0-2026-63490)

Vulnerability from cvelistv5 – Published: 2026-08-20 14:45 – Updated: 2026-08-25 14:41

Title

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Summary

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 14:41 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23 - Relative Path Traversal
CWE-552 - Files or Directories Accessible to External Parties

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/jknack/handlebars.java/securit…	x_refsource_CONFIRM
https://github.com/jknack/handlebars.java/commit/…	x_refsource_MISC
https://github.com/jknack/handlebars.java/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jknack	handlebars.java	Affected: < 4.5.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63490",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T14:41:31.447983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T14:41:57.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "handlebars.java",
          "vendor": "jknack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552: Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T14:45:35.727Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w"
        },
        {
          "name": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"
        },
        {
          "name": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3"
        }
      ],
      "source": {
        "advisory": "GHSA-g29j-rwfv-h99w",
        "discovery": "UNKNOWN"
      },
      "title": "Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63490",
    "datePublished": "2026-08-20T14:45:35.727Z",
    "dateReserved": "2026-07-16T21:49:52.068Z",
    "dateUpdated": "2026-08-25T14:41:57.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-G29J-RWFV-H99W

Summary

Vulnerable Code

SpringTemplateLoader.resolve - preserves file: / classpath: and applies suffix to the path portion

SpringTemplateLoader.getResource - no containment check

HandlebarsViewResolver - strips the outer prefix/suffix and forwards to compile, no validation

AbstractTemplateLoader.resolve - the load-bearing .hbs gate

Impact

Direct primitive

Real-world attack chains (downstream impact)

Indirect

Remediation

Apply the containment helper to SpringTemplateLoader.getResource (parity with d177cdee)

Validate the resolved URL components

Remove the protocol short-circuit entirely

Validate the stripped view name in HandlebarsViewResolver.configure

CVE-2026-63490 (GCVE-0-2026-63490)

Tags

Sightings

Nomenclature

`SpringTemplateLoader.resolve` - preserves `file:` / `classpath:` and applies suffix to the path portion

`SpringTemplateLoader.getResource` - no containment check

`HandlebarsViewResolver` - strips the outer prefix/suffix and forwards to compile, no validation

`AbstractTemplateLoader.resolve` - the load-bearing `.hbs` gate

Apply the containment helper to `SpringTemplateLoader.getResource` (parity with d177cdee)

Validate the stripped view name in `HandlebarsViewResolver.configure`