{"id":"CVE-2026-63490","title":"Handlebars.java provides logic-less and semantic Mustache templates with Java","summary":"Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader w…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22","CWE-23","CWE-552"],"vendor":"github","product":"com.github.jknack:handlebars-springmvc","affected":["com.github.jknack:handlebars-springmvc < 4.5.3"],"patched":["com.github.jknack:handlebars-springmvc 4.5.3"],"published":"2026-08-20","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63490","references":[{"url":"https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5","label":"security-advisories@github.com"},{"url":"https://github.com/jknack/handlebars.java/releases/tag/v4.5.3","label":"security-advisories@github.com"},{"url":"https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w","label":"security-advisories@github.com"},{"url":"https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63490"},{"url":"https://github.com/advisories/GHSA-g29j-rwfv-h99w"}],"tags":["nvd","ghsa","maven"],"epss":0.0047,"epssPercentile":0.39818,"aliases":["GHSA-g29j-rwfv-h99w"],"ecosystem":"maven","ingestedAt":"2026-09-02T22:51:44.421Z","slug":"CVE-2026-63490","body":"## Overview\n\nHandlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63490)\n\nAffected packages:\n\n- `com.github.jknack:handlebars-springmvc < 4.5.3`\n\nPatched in:\n\n- `com.github.jknack:handlebars-springmvc 4.5.3`\n\nSource: https://github.com/advisories/GHSA-g29j-rwfv-h99w","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}