Products: 1
Vulnerabilities: 3
Known Exploited: 0
0
Critical Level Threats
3
High Level Threats
0
Medium Level Threats
0
Low Level Threats
Vulnerabilities
100806040200
JanFebMarAprMayJunJulAugSepOctNovDec
Critical Level Threats
High Level Threats
Medium Level Threats
Low Level Threats
Products Security index
Actions
Items Per Page
Vulnerabilities
CVE-2026-103088
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.
Last Modified: Sep 30, 2026
Published: Sep 30, 2026
CVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
Last Modified: Aug 25, 2026
Published: Aug 20, 2026
CVE-2026-55760
handlebars.java FileTemplateLoader Path Traversal
Last Modified: Jul 10, 2026
Published: Jul 08, 2026
Items Per Page
