{"apiVersion":"1.0","identifier":"CVE-2026-63490","description":"Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.","publishedAt":"2026-08-20T15:18:04","lastModifiedAt":"2026-08-25T15:16:36","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63490","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","epssProbability":0.0047,"riskScore":0.78,"affectedProduct":"handlebars.java","affectedVersions":"<4.5.3","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-63490","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-63490","en":"https://www.redsauce.net/en/cves/CVE-2026-63490","fr":"https://www.redsauce.net/fr/cves/CVE-2026-63490","pt":"https://www.redsauce.net/pt/cves/CVE-2026-63490","de":"https://www.redsauce.net/de/cves/CVE-2026-63490","sk":"https://www.redsauce.net/sk/cves/CVE-2026-63490","el":"https://www.redsauce.net/el/cves/CVE-2026-63490"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-63490"}}