Arbitrary File Read in Handlebars.java SpringTemplateLoader via URL Fragment Bypass

Handlebars.java version 4.5.3 and earlier is vulnerable to an arbitrary file read vulnerability (CVE-2026-63490) within the SpringTemplateLoader component. The vulnerability arises because SpringTemplateLoader trusts Spring's ResourceLoader to resolve view names without applying the path-containment checks implemented in other loaders. The security boundary protecting the system relies on an unconditional .hbs suffix appended by AbstractTemplateLoader.

Attackers can bypass this suffix check by appending a URL fragment (#) to a user-influenced view name. Spring and the JDK treat the content following the fragment as metadata and discard it during resource resolution, effectively stripping the .hbs extension. This allows an attacker to manipulate the view path to point to arbitrary files on the filesystem readable by the JVM process. Successful exploitation leads to unauthenticated access to sensitive system files, including configuration files, API keys, CI/CD secrets, and service account tokens. This is particularly critical in Spring MVC applications that resolve view names based on user input.

Attack Chain

1. Attacker identifies a Spring MVC controller endpoint that returns a view name derived from user input (e.g., via query parameter or path variable).
2. Attacker crafts a malicious view name request containing a protocol prefix (e.g., file:) and the target file path.
3. Attacker appends a # character to the end of the path (e.g., file:/etc/passwd#).
4. HandlebarsViewResolver passes the attacker-influenced string to the handlebars.compile() method.
5. SpringTemplateLoader processes the path, and AbstractTemplateLoader appends .hbs after the # fragment.
6. Spring's ResourceLoader resolves the path, discarding the fragment part (#.hbs).
7. The application parses and renders the contents of the target file as a Handlebars template.
8. The HTTP response body returns the contents of the sensitive file to the attacker.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive files accessible to the application process UID. This includes, but is not limited to, application.yml files containing database credentials and secret keys, cloud environment credentials (AWS/GCP), Kubernetes service account tokens, private keys, and environment variables. These primitives enable full-system compromise, lateral movement within a network, or escalation of privileges in cloud-native environments.

Recommendation

Prioritize patching to version 4.5.3 or later of handlebars-springmvc. For applications where immediate patching is not possible, implement input validation in the view resolver to reject view names containing prohibited characters.

• Upgrade the com.github.jknack:handlebars-springmvc dependency to version 4.5.3 or higher to incorporate the fix for CVE-2026-63490.
• Implement an input validation layer in HandlebarsViewResolver.configure to detect and reject view names containing : or # characters.
• Conduct a code audit of all Spring MVC controllers to identify and refactor patterns where user input influences view names or template paths.
• Restrict file access for the JVM process to only necessary directories to minimize the impact of potential arbitrary file read primitives.