CVE-2026-63490

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63490
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63490.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63490
Aliases
  • GHSA-g29j-rwfv-h99w
Published
2026-08-20T14:45:35.727Z
Modified
2026-08-22T09:15:44.393441Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
Details

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-23",
        "CWE-552"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63490.json"
}
References

Affected packages

Git / github.com/jknack/handlebars.java

Affected ranges

Type
GIT
Repo
https://github.com/jknack/handlebars.java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
61f43423a337b87db5fec1fe59f0725aaaa38df5
Fixed
a733ae1e2b3b24d3857bd4cfff080130d777bdc7
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.5.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.2.0
handlebars.*
handlebars.java-0.1.0
handlebars.java-0.2.1
handlebars.java-0.2.2
handlebars.java-0.3.0
handlebars.java-0.3.1
handlebars.java-0.4.0
handlebars.java-0.4.1
handlebars.java-0.4.2
handlebars.java-0.5.0
handlebars.java-0.5.3
handlebars.java-0.5.4
handlebars.java-0.5.5
handlebars.java-0.6.1
handlebars.java-0.6.2
handlebars.java-0.7.0
v0.*
v0.10.0
v0.11.0
v0.12.0
v0.8.0
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.3.2
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.1
v2.3.2
v4.*
v4.0.0
v4.0.5
v4.0.6
v4.0.7
v4.1.0
v4.1.1
v4.1.2
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.4.0
v4.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63490.json"
vanir_signatures 
[
    {
        "target": {
            "function": "resolve",
            "file": "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java"
        },
        "deprecated": false,
        "source": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5",
        "id": "CVE-2026-63490-03aeaaba",
        "signature_version": "v1",
        "digest": {
            "length": 417.0,
            "function_hash": "189048322001925782931546065861680160374"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "handlebars-springmvc/src/test/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoaderTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/jknack/handlebars.java/commit/a733ae1e2b3b24d3857bd4cfff080130d777bdc7",
        "id": "CVE-2026-63490-12e16e6b",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283111640158751887371919179514456608793",
                "124424237208915413044693078024977295718",
                "128580819486392187617489657236963461290",
                "306044615348563623402137061147643785484",
                "110112269328007236743157190840262126045",
                "21767270511925541131599885177307795758",
                "2367167767513552376843969103825007714",
                "242541466008822052188930733002140932551",
                "173784460195689882239969544961718280505",
                "267174442745707036181733078993054549113",
                "125129305266544762237682132517201620426",
                "125447234951807086833307985166096436024",
                "303068627718475250610380021975769498734",
                "240463503037576781791468056994744625573",
                "21767270511925541131599885177307795758",
                "2367167767513552376843969103825007714",
                "242541466008822052188930733002140932551",
                "34759626407033902026278371536171684098",
                "24981344039524995588204155665602596450",
                "127517712127678984621956449642277012655",
                "15489294027092540617659836874620090305"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java"
        },
        "deprecated": false,
        "source": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5",
        "id": "CVE-2026-63490-4e96e63e",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "183761468201175679659138099181099908101",
                "147742068214475995042888476304373649123",
                "307163843331844970840244863110920486337",
                "166257965537882788533880066300401982794",
                "125483172516086890838847213705728220762",
                "61216548176903800072082083836046748128",
                "215103592913422223645852145898212954170",
                "23514186417129480334461058235179083014",
                "192399087117178078317423398901048719982",
                "37171824728493136345900589085831748430",
                "121530667960709232256712015912021662934",
                "114387268346263237604857219276877637100"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java"
        },
        "deprecated": false,
        "source": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5",
        "id": "CVE-2026-63490-8c1c31bd",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "12556972397938876904262034594577397291",
                "219030385066092940297697232469012820824",
                "201459153815000720943643615827038433505",
                "319807086485784421064917754111117292777",
                "146765013496801918948084321763651218358",
                "131684101238753803528354566851700515142",
                "261494752999438911161191518973037031666",
                "333871743910750682037289186890679024664",
                "265563099809951125418658445545367336846",
                "118557139800153660604301681569365497462",
                "53807451814544539454734025332506617865",
                "137294189825524959186783112390604501074",
                "339858015650258881245931771894059538084",
                "190797721656681291192142442993826322740",
                "329960580452948942597166270106893638408",
                "157952907195093260627707880009985355213",
                "223012828820754501401211258231179498115",
                "175718475126074852069558602250908340022",
                "90748865064192573537917112872207306375",
                "241253817615965569380395524864509925754",
                "300695396556594455707671855041016823476",
                "291696659561503734385355836663253155767",
                "263409651879307176551943944110824168418",
                "63974683328277093447878508410438699560",
                "61947625098248431834370035023104925425"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "handlebars-springmvc/src/test/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoaderTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5",
        "id": "CVE-2026-63490-d5b7d430",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "149844313103849893858802180184800941289",
                "265347308949425364589233001227435863470",
                "148602551397198423961953724310758317697",
                "236211497381344135076818836342754370936",
                "168607626548157139347622499053533330307",
                "321287582264850149415897288521133349532",
                "118176058011357964328556096815843335314",
                "185169329738221927801130623088258653381",
                "169743638174200832954260316650799559434",
                "307400370564346550457095523569628875493"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "configure",
            "file": "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java"
        },
        "deprecated": false,
        "source": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5",
        "id": "CVE-2026-63490-df192c78",
        "signature_version": "v1",
        "digest": {
            "length": 466.0,
            "function_hash": "164545399337510588322203006457352974054"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "getResource",
            "file": "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java"
        },
        "deprecated": false,
        "source": "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5",
        "id": "CVE-2026-63490-e497d7d4",
        "signature_version": "v1",
        "digest": {
            "length": 175.0,
            "function_hash": "304757198551881287477573073228682313543"
        },
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-08-22T09:15:44Z"