If you learned from my posts, inspired, or encouraged to grow in the cybersecurity and digital forensics, I would really appreciate your vote and support - Husam Shbib!
MyCyberNews
← Back to feed
Vulnerabilities & PatchesEmerging1 sourceAug 20, 2026 · 14:45via CVEFeed

CVE-2026-63490 - Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Brief

CVE ID : CVE-2026-63490

Published : Aug. 20, 2026, 2:45 p. m.

  • 23 minutes ago

Description : Handlebars. java provides logic-less and semantic Mustache templates with Java. Prior to 4.

  • 3, com. github. jknack. handlebars. springmvc. SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders.

In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader. java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended . hbs suffix in the fragment, which FileUrlResource. exists() and URL. openStream() discard.

HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.

Read more on CVEFeed→
Vulnerabilities & PatchesThreat Actors & CampaignsCVE-2026-63490