CVE-2026-63490: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jknack handlebars.java

Handlebars.java, a Java library for Mustache templates, prior to version 4.5.3, contains a path traversal vulnerability (CWE-22) in the SpringTemplateLoader class. The loader resolves Spring MVC view names influenced by attackers through Spring ResourceLoader without proper path containment validation. Specifically, when a view name uses a file: or classpath: URL ending with a fragment delimiter (#), the appended .hbs suffix is placed in the fragment, which is ignored by FileUrlResource.exists() and URL.openStream(). Consequently, HandlebarsViewResolver passes this attacker-controlled name to handlebars.compile(), enabling an unauthenticated remote attacker to read files accessible to the JVM if the application exposes a controller with a user-influenced view name. The vulnerability is addressed in version 4.5.3.

An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files accessible to the JVM process running the application. This can lead to disclosure of sensitive information. The CVSS score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

Upgrade handlebars.java to version 4.5.3 or later, where this path traversal vulnerability is fixed. No other mitigations are indicated or required according to the available information.