CyberRota Analysis
AI-GeneratedApplications using Handlebars.java versions prior to 4.5.2 are vulnerable to path traversal attacks when user-controlled input is passed to Handlebars.compile() via FileTemplateLoader or ClassPathTemplateLoader. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information. Developers and security teams utilizing Handlebars.java in their Java applications should prioritize upgrading to version 4.5.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.