CVE-2026-63490

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

Summary

com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves Spring MVC view names into URLs via Spring's ResourceLoader without applying the path-containment check that protects every other URL-based loader in the project (ClassPathTemplateLoader, FileTemplateLoader, ServletContextTemplateLoader - all hardened by commit d177cdee).

The only remaining defense for file: / classpath: view names is the unconditional .hbs suffix appended by AbstractTemplateLoader.resolve(...). This suffix is the load-bearing security boundary that prevents a request like view=file:/etc/passwd from reading /etc/passwd instead of /etc/passwd.hbs.

This boundary is bypassed by a single character: # (the URL fragment delimiter).

When the view name ends with #, the appended .hbs lands inside the URL fragment. Both Spring's FileUrlResource.exists() (via URI.getSchemeSpecificPart()) and the JDK's URL.openStream() (via URL.getFile()) silently discard the fragment, so the file actually opened is the bare path the attacker specified - for example /etc/passwd rather than /etc/passwd.hbs. The compiled "template" is then parsed and rendered into the HTTP response body.

Result: unauthenticated, network-reachable, arbitrary file read of any file readable by the JVM process on any Spring MVC application that uses a default-configured HandlebarsViewResolver and exposes a controller that returns a (fully or partly) user-influenced view name.

Vulnerable Code

SpringTemplateLoader.resolve - preserves file: / classpath: and applies suffix to the path portion

// handlebars-springmvc/.../SpringTemplateLoader.java:66-77
@Override
public String resolve(final String location) {
  String protocol = null;
  if (location.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {
    protocol = ResourceUtils.CLASSPATH_URL_PREFIX;
  } else if (location.startsWith(ResourceUtils.FILE_URL_PREFIX)) {
    protocol = ResourceUtils.FILE_URL_PREFIX;          // matches "file:"
  }
  if (protocol == null) {
    return super.resolve(location);
  }
  return protocol + super.resolve(location.substring(protocol.length()));
}

SpringTemplateLoader.getResource - no containment check

// handlebars-springmvc/.../SpringTemplateLoader.java:57-63
@Override
protected URL getResource(final String location) throws IOException {
  Resource resource = loader.getResource(location);   // trust Spring blindly
  if (!resource.exists()) {
    return null;
  }
  return resource.getURL();
}

Contrast with the hardened sibling ClassPathTemplateLoader.getResource, which delegates to URLTemplateLoader.classpathResource(...) - the containment helper added by commit d177cdee:

// handlebars/.../io/URLTemplateLoader.java:75-93   (the d177cdee hardening)
protected final String classpathResource(String location) {
  String resolvedPath =
      Paths.get(location).normalize().toString().replace(java.io.File.separatorChar, '/');
  if (location.startsWith("/") && !resolvedPath.startsWith("/")) {
    resolvedPath = "/" + resolvedPath;
  }
  String prefix = getPrefix();
  if (!prefix.equals("/") && !resolvedPath.startsWith(prefix)) {
    throw new IllegalArgumentException(
        "Path traversal attempt detected. Resolved path escapes base prefix: " + location);
  }
  return resolvedPath;
}

SpringTemplateLoader.getResource never calls this helper.

HandlebarsViewResolver - strips the outer prefix/suffix and forwards to compile, no validation

// handlebars-springmvc/.../HandlebarsViewResolver.java:112-117
public HandlebarsViewResolver(final Class<? extends HandlebarsView> viewClass) {
  setViewClass(viewClass);
  setContentType(DEFAULT_CONTENT_TYPE);
  setPrefix(TemplateLoader.DEFAULT_PREFIX);   // "/"
  setSuffix(TemplateLoader.DEFAULT_SUFFIX);   // ".hbs"
}

// handlebars-springmvc/.../HandlebarsViewResolver.java:163-178
protected AbstractUrlBasedView…

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

Summary

com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves Spring MVC view names into URLs via Spring's ResourceLoader without applying the path-containment check that protects every other URL-based loader in the project (ClassPathTemplateLoader, FileTemplateLoader, ServletContextTemplateLoader - all hardened by commit d177cdee).

The only remaining defense for file: / classpath: view names is the unconditional .hbs suffix appended by AbstractTemplateLoader.resolve(...). This suffix is the load-bearing security boundary that prevents a request like view=file:/etc/passwd from reading /etc/passwd instead of /etc/passwd.hbs.

This boundary is bypassed by a single character: # (the URL fragment delimiter).

When the view name ends with #, the appended .hbs lands inside the URL fragment. Both Spring's FileUrlResource.exists() (via URI.getSchemeSpecificPart()) and the JDK's URL.openStream() (via URL.getFile()) silently discard the fragment, so the file actually opened is the bare path the attacker specified - for example /etc/passwd rather than /etc/passwd.hbs. The compiled "template" is then parsed and rendered into the HTTP response body.

Result: unauthenticated, network-reachable, arbitrary file read of any file readable by the JVM process on any Spring MVC application that uses a default-configured HandlebarsViewResolver and exposes a controller that returns a (fully or partly) user-influenced view name.

Vulnerable Code

SpringTemplateLoader.resolve - preserves file: / classpath: and applies suffix to the path portion

// handlebars-springmvc/.../SpringTemplateLoader.java:66-77
@Override
public String resolve(final String location) {
  String protocol = null;
  if (location.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {
    protocol = ResourceUtils.CLASSPATH_URL_PREFIX;
  } else if (location.startsWith(ResourceUtils.FILE_URL_PREFIX)) {
    protocol = ResourceUtils.FILE_URL_PREFIX;          // matches "file:"
  }
  if (protocol == null) {
    return super.resolve(location);
  }
  return protocol + super.resolve(location.substring(protocol.length()));
}

SpringTemplateLoader.getResource - no containment check

// handlebars-springmvc/.../SpringTemplateLoader.java:57-63
@Override
protected URL getResource(final String location) throws IOException {
  Resource resource = loader.getResource(location);   // trust Spring blindly
  if (!resource.exists()) {
    return null;
  }
  return resource.getURL();
}

Contrast with the hardened sibling ClassPathTemplateLoader.getResource, which delegates to URLTemplateLoader.classpathResource(...) - the containment helper added by commit d177cdee:

// handlebars/.../io/URLTemplateLoader.java:75-93   (the d177cdee hardening)
protected final String classpathResource(String location) {
  String resolvedPath =
      Paths.get(location).normalize().toString().replace(java.io.File.separatorChar, '/');
  if (location.startsWith("/") && !resolvedPath.startsWith("/")) {
    resolvedPath = "/" + resolvedPath;
  }
  String prefix = getPrefix();
  if (!prefix.equals("/") && !resolvedPath.startsWith(prefix)) {
    throw new IllegalArgumentException(
        "Path traversal attempt detected. Resolved path escapes base prefix: " + location);
  }
  return resolvedPath;
}

SpringTemplateLoader.getResource never calls this helper.

HandlebarsViewResolver - strips the outer prefix/suffix and forwards to compile, no validation

// handlebars-springmvc/.../HandlebarsViewResolver.java:112-117
public HandlebarsViewResolver(final Class<? extends HandlebarsView> viewClass) {
  setViewClass(viewClass);
  setContentType(DEFAULT_CONTENT_TYPE);
  setPrefix(TemplateLoader.DEFAULT_PREFIX);   // "/"
  setSuffix(TemplateLoader.DEFAULT_SUFFIX);   // ".hbs"
}

// handlebars-springmvc/.../HandlebarsViewResolver.java:163-178
protected AbstractUrlBasedView…