CVE-2026-55760 — handlebars.java FileTemplateLoader Path Traversal
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTem…
Published: 2026-07-08 · CVSS: 7.5 · CVSS 3.1
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7