{"id":"CVE-2026-55760","title":"handlebars.java FileTemplateLoader Path Traversal","summary":"handlebars.java FileTemplateLoader Path Traversal","severity":"high","cvss":7.5,"cwe":["CWE-22"],"vendor":"github","product":"com.github.jknack:handlebars","ecosystem":"maven","affected":["com.github.jknack:handlebars < 4.5.2"],"patched":["com.github.jknack:handlebars 4.5.2"],"published":"2026-06-17","updated":"2026-06-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-r4gv-qr8j-p3pg","references":[{"url":"https://github.com/jknack/handlebars.java/security/advisories/GHSA-r4gv-qr8j-p3pg"},{"url":"https://github.com/advisories/GHSA-r4gv-qr8j-p3pg"}],"tags":["ghsa","maven"],"ingestedAt":"2026-06-29T14:31:47.186Z","epss":0.0053,"epssPercentile":0.43742,"slug":"CVE-2026-55760","body":"## Overview\n\n### Impact\nAny application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.\n\n### Patches\ncom.github.jknack:handlebars:4.5.2\n\n### Workarounds\n\nValidate template name is derived from user input. \n\n```java\nif (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) {\n        throw new IOException(\"Path traversal attempt detected: \" + location);\n}\n```\n\n## Affected packages\n\n- `com.github.jknack:handlebars < 4.5.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `com.github.jknack:handlebars 4.5.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}