GHSA-r4gv-qr8j-p3pg
handlebars.java FileTemplateLoader Path Traversal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.github.jknack:handlebars | < 4.5.2 | 4.5.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources.
### Patches
com.github.jknack:handlebars:4.5.2
### Workarounds
Validate template name is derived from user input.
```java
if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) {
throw new IOException("Path traversal attempt detected: " + location);
}
```
References
External links from the advisory. They lead to third-party sites.