Path Traversal Vulnerability in Handlebars.java Allows Arbitrary File Read

CVE-2026-55760

What is CVE-2026-55760?

Handlebars.java, a Java library for semantic Mustache templates, exhibits a path traversal vulnerability that occurs when applications pass user-controlled input to Handlebars.compile() using either FileTemplateLoader or ClassPathTemplateLoader. In versions prior to 4.5.2, this flaw permits attackers to perform arbitrary file read operations by manipulating template names derived from URL path parameters, request parameters, or other user-controlled sources. This vulnerability compromises the security and integrity of the affected applications, allowing unauthorized access to sensitive files.

References