---
id: CVE-2026-63490
title: Handlebars.java provides logic-less and semantic Mustache templates with Java
summary: >-
  Handlebars.java provides logic-less and semantic Mustache templates with Java.
  Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader
  resolves attacker-influenced Spring MVC view names through Spring
  ResourceLoader w…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
  - CWE-23
  - CWE-552
vendor: github
product: 'com.github.jknack:handlebars-springmvc'
affected:
  - 'com.github.jknack:handlebars-springmvc < 4.5.3'
patched:
  - 'com.github.jknack:handlebars-springmvc 4.5.3'
published: '2026-08-20'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63490'
references:
  - url: >-
      https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5
    label: security-advisories@github.com
  - url: 'https://github.com/jknack/handlebars.java/releases/tag/v4.5.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w
    label: security-advisories@github.com
  - url: >-
      https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63490'
  - url: 'https://github.com/advisories/GHSA-g29j-rwfv-h99w'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00688
epssPercentile: 0.50665
aliases:
  - GHSA-g29j-rwfv-h99w
ecosystem: maven
ingestedAt: '2026-09-02T22:51:44.421Z'
---

## Overview

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63490)

Affected packages:

- `com.github.jknack:handlebars-springmvc < 4.5.3`

Patched in:

- `com.github.jknack:handlebars-springmvc 4.5.3`

Source: https://github.com/advisories/GHSA-g29j-rwfv-h99w