---
id: CVE-2026-55760
title: handlebars.java FileTemplateLoader Path Traversal
summary: handlebars.java FileTemplateLoader Path Traversal
severity: high
cvss: 7.5
cwe:
  - CWE-22
vendor: github
product: 'com.github.jknack:handlebars'
ecosystem: maven
affected:
  - 'com.github.jknack:handlebars < 4.5.2'
patched:
  - 'com.github.jknack:handlebars 4.5.2'
published: '2026-06-17'
updated: '2026-06-17'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-r4gv-qr8j-p3pg'
references:
  - url: >-
      https://github.com/jknack/handlebars.java/security/advisories/GHSA-r4gv-qr8j-p3pg
  - url: 'https://github.com/advisories/GHSA-r4gv-qr8j-p3pg'
tags:
  - ghsa
  - maven
ingestedAt: '2026-06-29T14:31:47.186Z'
epss: 0.0053
epssPercentile: 0.42294
---

## Overview

### Impact
Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.

### Patches
com.github.jknack:handlebars:4.5.2

### Workarounds

Validate template name is derived from user input. 

```java
if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) {
        throw new IOException("Path traversal attempt detected: " + location);
}
```

## Affected packages

- `com.github.jknack:handlebars < 4.5.2`

## Remediation

Upgrade to a patched release:

- `com.github.jknack:handlebars 4.5.2`