Executive brief
Handlebars.java is a popular Java templating engine used in Spring MVC applications to render HTML views. The SpringTemplateLoader component fails to validate file paths, allowing attackers to read arbitrary files from the server by exploiting how URLs handle fragment identifiers (the `#` character). An unauthenticated attacker can extract sensitive configuration files containing database passwords, API keys, or cloud credentials, leading to complete compromise of the application and its infrastructure.
Technical details
The vulnerability exists in the SpringTemplateLoader component which handles template resolution in Spring MVC applications using Handlebars. The class accepts `file:` and `classpath:` prefixed view names and delegates to Spring's ResourceLoader without applying path containment checks that protect other template loaders. The security boundary relies on an unconditional `.hbs` suffix appended by AbstractTemplateLoader.resolve(). When a view name ends with the fragment delimiter `#`, the appended `.hbs` lands inside the URL fragment portion. Both Spring's FileUrlResource.exists() and the JDK's URL.openStream() silently discard URL fragments during file resolution, causing the attacker-specified path (e.g., `/etc/passwd`) to be opened instead of the suffixed version (`/etc/passwd.hbs`). The compiled template content is then rendered into the HTTP response. Attack vector is network-accessible and requires no authentication. Real-world chains include extracting JWT secrets or database credentials from application.yml, harvesting cloud IAM credentials, reading Kubernetes service tokens, or exfiltrating SSH private keys. Patch version 4.5.3 implements path containment validation and URL component sanitization.
Affected products
- jknack handlebars-springmvc < 4.5.3
Timeline
- 2026-07-01: disclosed
- 2026-09-02: advisory
- 2026-09-02: patched: Version 4.5.3 released