CVE-2026-103088 is a directory traversal vulnerability in handlebars.java before version 4.5.5. Specifically, in handlebars-springmvc versions 4.5.3 and 4.5.4, the fix for a previous vulnerability (CVE-2026-63490) incorrectly validates template locations as raw percent-encoded strings, while the template file is accessed through a URL handler that percent-decodes the path. This discrepancy allows an attacker to use percent-encoded traversal sequences (e.g., %2e%2e/) to bypass both the view-resolver and loader-side containment checks, enabling reading of files outside the configured template base directory in Spring MVC applications using a file: template prefix and request-derived view names.

An attacker can read arbitrary files outside the configured template base directory, potentially exposing sensitive information. The vulnerability does not allow code execution or denial of service but compromises confidentiality by unauthorized file access.

Upgrade handlebars.java to version 4.5.5 or later, where this directory traversal vulnerability is fixed. No other mitigations are indicated by the vendor advisory.