Product

Handlebars-Springmvc (< 4.5.3)

1 brief RSS

Arbitrary File Read in Handlebars.java SpringTemplateLoader via URL Fragment Bypass

An unauthenticated arbitrary file read vulnerability (CVE-2026-63490) exists in handlebars-springmvc < 4.5.3 due to insufficient validation of user-influenced view names, allowing attackers to bypass file suffix restrictions using URL fragments.

handlebars-springmvc cve-2026-63490 arbitrary-file-read spring-mvc template-injection

1r 1t 1c 1h ago