CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

CVE-2026-103088

Handlebars.java versions prior to 4.5.5 are vulnerable to a directory traversal flaw. Specifically, in handlebars-springmvc versions 4.5.3 and 4.5.4 , the path-containment fix for CVE-2026-63490 incorrectly validates template locations as raw percent-encoded strings while the underlying URL handl...

CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

EUVD-2026-89555

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

pl.allegro.tech.boot:handlebars-spring-boot-starter (0.2.5) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.3.0)

com.github.jknack:handlebars-springmvc MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter 0.2.5 Source cves: CVE-2026-634...

de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0), events.boudicca:eventcollector-client (>=0.6.0, <=0.7.0) +4 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=4.0.0, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =4.0.0, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.8, =0.5.0 Source cves: CVE-2026-63490 Source advisory: GHSA-G29J-RWFV-H99W...

de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0), events.boudicca:eventcollector-client (>=0.6.0, <=0.7.0) +4 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=4.0.0, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =4.0.0, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.8, =0.5.0 Source cves: CVE-2026-63490 Source advisory: OSV:GHSA-G29J-RWFV-H99W...

pl.allegro.tech.boot:handlebars-spring-boot-starter (0.2.7) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.3.2)

com.github.jknack:handlebars-springmvc MAVEN version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter 0.2.7 Source cves: CVE-2026-634...

com.github.jknack:todomvc-jpa (>=0.3.4, <=0.3.6) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (0.6.1)

com.github.jknack:handlebars-springmvc MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - com.github.jknack:todomvc-jpa =0.3.4, =0.3.6 Source cves: CVE-2026-63490 Source...

pl.allegro.tech.boot:handlebars-spring-boot-starter (0.2.2) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.2.0)

com.github.jknack:handlebars-springmvc MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter 0.2.2 Source cves: CVE-2026-634...

pl.allegro.tech.boot:handlebars-spring-boot-starter (>=0.2.0, <=0.2.1), pl.allegro.tech.boot:spring-boot-starter-handlebars (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.0.0)

com.github.jknack:handlebars-springmvc MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter =0.2.0, =0.1.0, =0.1.1 Source...

pl.allegro.tech.boot:handlebars-spring-boot-starter (>=0.2.3, <=0.2.4) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.2.3)

com.github.jknack:handlebars-springmvc MAVEN version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter =0.2.3, =0.2.4 Source cves:...

pl.allegro.tech.boot:handlebars-spring-boot-starter (0.2.6) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.3.1)

com.github.jknack:handlebars-springmvc MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter 0.2.6 Source cves: CVE-2026-634...

de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0), events.boudicca:eventcollector-client (>=0.6.0, <=0.7.0) +4 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=4.0.0, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =4.0.0, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.8, =0.5.0 Source cves: CVE-2026-63490 Source advisory: SNYK:JAVA-COMGITHUBJKNACK-19233596...

com.github.jknack:todomvc-jpa (>=0.3.4, <=0.3.6), de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0) +6 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=0.6.1, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =0.6.1, =0.3.4, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-63490 Source advisory: MEND:CVE-2026-63490...

com.github.jknack:handlebars-humanize (0.5.2), com.github.jknack:handlebars-jackson2 (0.5.2) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.2)

com.github.jknack:handlebars MAVEN version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.2 - com.github.jknack:handlebars-jackson2 0.5.2 -...

com.github.jknack:handlebars-jackson2 (0.4.1), com.github.jknack:handlebars-json (0.4.1) +2 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.4.1)

com.github.jknack:handlebars MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-jackson2 0.4.1 - com.github.jknack:handlebars-json 0.4.1 -...

com.github.jknack:handlebars-humanize (0.5.1), com.github.jknack:handlebars-jackson2 (0.5.1) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.1)

com.github.jknack:handlebars MAVEN version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.1 - com.github.jknack:handlebars-jackson2 0.5.1 -...