CVE-2026-63490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63490", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T21:49:52.068Z", "datePublished": "2026-08-20T14:45:35.727Z", "dateUpdated": "2026-08-25T14:41:57.989Z"}, "containers": {"cna": {"title": "Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-23", "lang": "en", "description": "CWE-23: Relative Path Traversal", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-552", "lang": "en", "description": "CWE-552: Files or Directories Accessible to External Parties", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w"}, {"name": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5", "tags": ["x_refsource_MISC"], "url": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"}, {"name": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3"}], "affected": [{"vendor": "jknack", "product": "handlebars.java", "versions": [{"version": "< 4.5.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T14:45:35.727Z"}, "descriptions": [{"lang": "en", "value": "Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3."}], "source": {"advisory": "GHSA-g29j-rwfv-h99w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T14:41:31.447983Z", "id": "CVE-2026-63490", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:41:57.989Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63490", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:41:31.447983Z"}}}], "references": [{"url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:41:50.743Z"}}], "cna": {"title": "Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass", "source": {"advisory": "GHSA-g29j-rwfv-h99w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jknack", "product": "handlebars.java", "versions": [{"status": "affected", "version": "< 4.5.3"}]}], "references": [{"url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w", "name": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5", "name": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3", "name": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552: Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T14:45:35.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63490", "state": "PUBLISHED", "dateUpdated": "2026-08-25T14:41:57.989Z", "dateReserved": "2026-07-16T21:49:52.068Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T14:45:35.727Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "handlebars.java", "vendor": "jknack", "versions": [{"status": "affected", "version": "< 4.5.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3."}, {"lang": "es", "value": "Handlebars.java proporciona plantillas Mustache sin l\u00f3gica y sem\u00e1nticas con Java. Antes de la versi\u00f3n 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resuelve nombres de vista de Spring MVC influenciados por el atacante a trav\u00e9s de Spring ResourceLoader sin la validaci\u00f3n de contenci\u00f3n de ruta utilizada por otros cargadores basados en URL. En handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, un nombre de vista que utiliza una URL file: o classpath: y que termina con el delimitador de fragmento # coloca el sufijo .hbs adjunto en el fragmento, que FileUrlResource.exists() y URL.openStream() descartan. HandlebarsViewResolver en handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java luego pasa el nombre controlado por el atacante a handlebars.compile(), permitiendo a un atacante remoto no autenticado leer archivos accesibles para la JVM cuando una aplicaci\u00f3n expone un controlador con un nombre de vista influenciado por el usuario. Este problema est\u00e1 solucionado en la versi\u00f3n 4.5.3."}], "id": "CVE-2026-63490", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63490", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T14:41:31.447983Z", "version": "2.0.3"}}]}, "published": "2026-08-20T15:18:04.577", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"}, {"source": "security-advisories@github.com", "url": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}, {"lang": "en", "value": "CWE-552"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.5.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "handlebars.java", "source": "cna", "vendor": "jknack"}, "product": "handlebars.java", "vendor": "jknack"}], "created": "2026-08-20T16:45:16.690676+00:00", "updated": "2026-08-20T20:45:04.600008+00:00", "vendors": ["jknack", "jknack$PRODUCT$handlebars.java"]}