https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:48:29 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-335348 EUVD-2026-335348 https://cve.radiocsirt.org/vuln/euvd-2026-335348 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55760 <p>Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.</p> <p>Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55760 https://cve.radiocsirt.org/vuln/ghsa-r4gv-qr8j-p3pg <p><strong>Affected:</strong> Maven: com.github.jknack:handlebars</p> <p>### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.</p> <p>### Patches com.github.jknack:handlebars:4.5.2</p> <p>### Workarounds</p> <p>Validate template name is derived from user input.</p> <p>```java if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) { throw new IOException(&#34;Path traversal attempt detected: &#34; + location); } ```</p> <p><strong>Affected:</strong> Maven: com.github.jknack:handlebars</p> <p>### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.</p> <p>### Patches com.github.jknack:handlebars:4.5.2</p> <p>### Workarounds</p> <p>Validate template name is derived from user input.</p> <p>```java if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) { throw new IOException(&#34;Path traversal attempt detected: &#34; + location); } ```</p> https://cve.radiocsirt.org/vuln/ghsa-r4gv-qr8j-p3pg