Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compil…

CVE-2026-55760 is a path traversal vulnerability in Handlebars.java, a Java-based logic-less Mustache template engine. Versions prior to 4.5.2 are affected. The vulnerability exists when applications pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader. Attackers can exploit this to perform arbitrary file reads on the host system by crafting malicious template names derived from URL path parameters, request parameters, or other user-controlled sources. This poses a significant risk to applications that dynamically compile templates based on user input. The vulnerability has been patched in version 4.5.2 of Handlebars.java. Developers are strongly advised to upgrade to the fixed version to mitigate exposure to unauthorized file access.