CVE-2026-63490

creationtimestamp| type| source ---|---|--- 2026-08-20 17:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjpvjbeij2o 2026-09-03 11:31:46+00:00| seen| https://gist.github.com/alon710/ac9a336078ecd53e84e4088322a7f9af...

CVE-2026-63490

CVE-2026-63490 is an arbitrary file read vulnerability in the handlebars-springmvc module of Handlebars.java (prior to 4.5.3). The SpringTemplateLoader resolves Spring MVC view names via Spring's ResourceLoader without path-containment validation. An attacker can craft a view name using a file: o...