Vulnerability in Handlebars Java Affects Spring MVC View Templates

CVE-2026-63490

What is CVE-2026-63490?

The Handlebars Java library, used for semantic templates in Java applications, contains a vulnerability that allows an unauthenticated remote attacker to exploit the Spring MVC view name resolution process. This vulnerability arises when attacker-influenced view names, particularly those utilizing a 'file:' or 'classpath:' URL scheme, are processed without proper path-containment validations. When such a view name includes a fragment identifier—e.g., ending with '#'—the appended '.hbs' suffix is inadvertently processed, leading to unauthorized file access within the Java Virtual Machine (JVM). This poses a significant security risk, as it permits potential reading of sensitive files from the server's filesystem when a controller exposes a user-influenced view name. The issue has been resolved in version 4.5.3 of the library.

References