CVE-2026-103088
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.
CVE-2026-103088
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103088
handlebars.java
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/jknack/handlebars.java",
"vendor": "jknack",
"product": "handlebars.java",
"versions": [
{
"status": "affected",
"version": "4.5.3",
"lessThan": "4.5.5",
"versionType": "maven"
}
],
"packageURL": "pkg:maven/com.github.jknack/handlebars-springmvc",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-103088
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #4741 · Revision 1
- Added to Heist Feed
- Publisher date