CVE-2026-55760: Handlebars.java Path Traversal Vulnerability

CVE-2026-55760 Overview

CVE-2026-55760 is a path traversal vulnerability in Handlebars.java, a Java library that provides logic-less and semantic Mustache templates. Versions prior to 4.5.2 allow arbitrary file read when applications pass user-controlled input to Handlebars.compile() through FileTemplateLoader or ClassPathTemplateLoader. Attackers can craft template names derived from URL path parameters, request parameters, or other user-controlled sources to traverse the file system. The issue is tracked as [CWE-22] and is fixed in version 4.5.2.

Critical Impact
Unauthenticated network-based attackers can read arbitrary files accessible to the application process, exposing configuration files, credentials, and source code.

Affected Products

Handlebars.java versions prior to 4.5.2
Applications using FileTemplateLoader with user-controlled template names
Applications using ClassPathTemplateLoader with user-controlled template names

Discovery Timeline

2026-07-08 - CVE-2026-55760 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55760

Vulnerability Analysis

Handlebars.java resolves templates through loader implementations that combine a configured prefix, the requested template name, and a suffix into a resource path. Prior to 4.5.2, neither FileTemplateLoader nor ClassPathTemplateLoader validated that the resulting path stayed within the intended template directory. When developers pass user-supplied strings directly into Handlebars.compile(), an attacker can supply sequences such as ../../../etc/passwd or absolute paths to escape the template root.

The library returns the file contents as template source, which the application then renders. Even when rendering fails, the raw file contents may be reflected in error messages or logs. The vulnerability affects confidentiality only, with no impact on integrity or availability, according to the published CVSS vector.

Root Cause

The root cause is missing normalization and boundary validation in AbstractTemplateLoader and its subclasses. The loaders concatenated the prefix, template name, and suffix without confirming the resolved path remained within the configured base directory or classpath prefix. The EPSS score for this issue is 0.414% (percentile 33.362).

Attack Vector

Exploitation requires an application endpoint that forwards untrusted input to Handlebars.compile(). A typical attack sends an HTTP request such as GET /render?template=../../../../etc/passwd where the template parameter is used as the template name. Because PR:N and UI:N apply, no authentication or user interaction is required.

java

// Security patch in AbstractTemplateLoader.java
package com.github.jknack.handlebars.io;

-import static org.apache.commons.lang3.StringUtils.defaultString;
import static org.apache.commons.lang3.Validate.notNull;

import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
+import java.util.Objects;

/**
 * Strategy interface for loading resources from class path, file system, etc.
 */
// Source: https://github.com/jknack/handlebars.java/commit/d177cdee8b750385ca7a0d0f89f2d4be73e28f4e

java

// Security patch in ClassPathTemplateLoader.java
public ClassPathTemplateLoader(final String prefix, final String suffix) {
  setPrefix(prefix);
  setSuffix(suffix);
+ validatePrefixSuffix();
}
// Source: https://github.com/jknack/handlebars.java/commit/d177cdee8b750385ca7a0d0f89f2d4be73e28f4e

The patch introduces validatePrefixSuffix() and removes reliance on defaultString, forcing explicit null checks and prefix validation to prevent traversal.

Detection Methods for CVE-2026-55760

Indicators of Compromise

Web server or application logs containing template parameters with ../, ..\, %2e%2e%2f, or absolute paths such as /etc/, C:\Windows\.
Handlebars runtime exceptions referencing files outside the expected template directory.
Outbound responses reflecting contents of /etc/passwd, application.properties, or similar sensitive files.

Detection Strategies

Perform a Software Composition Analysis (SCA) scan across build artifacts and running JVMs for Handlebars.java versions earlier than 4.5.2.
Add web application firewall (WAF) rules that inspect query and path parameters for encoded traversal sequences before they reach application endpoints.
Instrument application code paths that invoke Handlebars.compile() with logging that records the resolved template path for review.

Monitoring Recommendations

Alert on file access by the Java process to paths outside the configured template directory.
Monitor HTTP responses for signatures of sensitive files, such as root:x:0:0: from /etc/passwd.
Correlate repeated TemplateNotFoundException or IOException events with the source IP to identify enumeration attempts.

How to Mitigate CVE-2026-55760

Immediate Actions Required

Upgrade Handlebars.java to version 4.5.2 or later in all applications and dependencies.
Audit source code for calls to Handlebars.compile(), Handlebars.compileInline(), and template loader configuration that accept user input.
Rotate any credentials or secrets stored in files that may have been exposed through vulnerable endpoints.

Patch Information

The fix is available in GitHub Release v4.5.2. Technical details are documented in the GitHub Security Advisory GHSA-r4gv-qr8j-p3pg and the GitHub Commit Details.

Workarounds

Never pass raw user input to Handlebars.compile(); instead, map user input to a static allowlist of template names.
Validate template names against a strict regex such as ^[A-Za-z0-9_-]+$ before invoking the loader.
Run the application with least-privilege file system permissions so sensitive files are unreadable by the JVM user.

bash

# Maven dependency upgrade
<dependency>
  <groupId>com.github.jknack</groupId>
  <artifactId>handlebars</artifactId>
  <version>4.5.2</version>
</dependency>

# Gradle dependency upgrade
implementation 'com.github.jknack:handlebars:4.5.2'