Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass — GHSA-G29J-RWFV-H99W

Summary

### Summary `com.github.jknack.handlebars.springmvc.SpringTemplateLoader` resolves Spring MVC view names into URLs via Spring's `ResourceLoader` **without applying the path-containment check** that protects every other URL-based loader in the project (`ClassPathTemplateLoader`, `FileTemplateLoader`, `ServletContextTemplateLoader` - all hardened by commit `d177cdee`). The only remaining defense for `file:` /…

Timeline

Published by source

2026-09-02

Risk context

• Reported severity or threat level: high.
• Reported CVSS score: 7.5 out of 10.
• Reported EPSS value: 0.0047.
• Review exposure for the affected product or family: maven: com.github.jknack:handlebars-springmvc.

Product

maven: com.github.jknack:handlebars-springmvc

What to do

General, cautious steps (verify details in the official source):

• Prioritize patching or mitigation immediately (treat as actively risky).
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Evidence and provenance

Canonical advisory ID

GHSA-G29J-RWFV-H99W

Source

GitHub

Vendor

GitHub

Published by source

2026-09-02

Last source activity

2026-09-02

Additional identifiers

CVE-2026-63490

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.