{"schema":"threatline.record/2","record":{"id":"CVE-2026-103088","aliases":["GHSA-pvrx-3g7m-fpgv"],"summary":"Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded string","details":"Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.","categories":["Libraries & packages"],"product":"handlebars.java","vendor":"jknack","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103088","source_modified_at":"2026-09-30T17:21:46.603Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"handlebars.java","vendor":"jknack","versions":[{"lessThan":"4.5.5","status":"affected","version":"4.5.3","versionType":"maven"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103088","source_modified_at":"2026-09-30T17:21:46.603Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"handlebars.java","ecosystem":null},"version":"4.5.5","basis":"first unaffected version stated in the CVE record"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00689,"percentile":0.52221,"score_date":"2026-10-23"},"published_at":"2026-09-30T00:55:19.940Z","modified_at":"2026-09-30T17:21:46.603Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103088","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T17:21:46.603Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103088","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/jknack/handlebars.java/security/advisories/GHSA-pvrx-3g7m-fpgv","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/jknack/handlebars.java/commit/f6ae3979917d05bef07f00befb4013ef00503660"},{"source":"CVE List","url":"https://github.com/jknack/handlebars.java/releases/tag/v4.5.5"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-30T17:13:35.282546Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T17:21:46.603Z","content_hash":"d2aa2cf22aab58a7f95306611893f53a6cc64485679797d98dfe844eff7aa502"}}