CVE-2026-55760: handlebars.java FileTemplateLoader Path Traversal

June 17, 2026

Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.

References

github.com/advisories/GHSA-r4gv-qr8j-p3pg
github.com/jknack/handlebars.java/security/advisories/GHSA-r4gv-qr8j-p3pg
nvd.nist.gov/vuln/detail/CVE-2026-55760

Code Behaviors & Features

Detect and mitigate CVE-2026-55760 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →