7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55760

CVE-2026-55760: handlebars.java FileTemplateLoader Path Traversal

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55760

CVE-2026-55760:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.github.jknack:handlebars	maven	< 4.5.2	4.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue affecting multiple template loaders in the handlebars.java library. The root cause is the lack of input validation on the location parameter passed to the getResource method in FileTemplateLoader, ClassPathTemplateLoader, and ServletContextTemplateLoader. An attacker could provide a crafted path with traversal sequences (../) to read arbitrary files from the filesystem or the application's classpath.

The patch addresses this by introducing strict path validation. For FileTemplateLoader, it canonicalizes the base directory and the requested file path, ensuring the file's path starts with the base directory's path. For classpath-based loaders (ClassPathTemplateLoader and ServletContextTemplateLoader), a new method, classpathResource, was added to the parent URLTemplateLoader. This method normalizes the path and verifies that it remains within the configured base prefix, throwing an exception if an escape attempt is detected. The getResource methods in the subclasses were updated to call this new validation method.

By identifying the changes in the getResource methods of these three loader classes, we can pinpoint the exact functions that, when called with malicious input, would trigger the vulnerability. These functions are the runtime indicators of exploitation.

Vulnerable functions

com.github.jknack.handlebars.io.FileTemplateLoader.getResource

handlebars/src/main/java/com/github/jknack/handlebars/io/FileTemplateLoader.java

The original implementation of this function created a `File` object directly from the `location` parameter without sanitization. This allowed an attacker to use path traversal sequences (e.g., `../`) to access files outside of the intended base directory. The patch fixes this by canonicalizing the paths and ensuring the resolved file path is still within the configured base directory.

com.github.jknack.handlebars.io.ClassPathTemplateLoader.getResource

handlebars/src/main/java/com/github/jknack/handlebars/io/ClassPathTemplateLoader.java

The function was vulnerable because it used the unsanitized `location` parameter to load a resource from the classpath. This could allow an attacker to traverse the classpath and access sensitive files (e.g., property files, class files). The patch delegates the path handling to a new `classpathResource` method which normalizes and validates the path against a base prefix.

com.github.jknack.handlebars.io.ServletContextTemplateLoader.getResource

handlebars/src/main/java/com/github/jknack/handlebars/io/ServletContextTemplateLoader.java

Similar to `ClassPathTemplateLoader`, this function used the unsanitized `location` parameter to load a resource via `servletContext.getResource()`. This created a path traversal vulnerability, allowing an attacker to access arbitrary files within the web application's context. The fix applies the same `classpathResource` validation method to sanitize the path before use.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.