Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2,
    applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or
    ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template
    names derived from URL path parameters, request parameters, or other user-controlled sources. This issue
    is fixed in version 4.5.2. (CVE-2026-55760)

ID	Name	Product	Family	Type	Severity
461544	Echo: com.github.jknack:handlebars, handlebars: security update to 4.5.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
461544	Echo: com.github.jknack:handlebars, handlebars: security update to 4.5.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
443384	SCA: security update for com.github.jknack:handlebars (GHSA-r4gv-qr8j-p3pg)	Tenable Cloud Security	SCA Checks	Local	high
443384	SCA: security update for com.github.jknack:handlebars (GHSA-r4gv-qr8j-p3pg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-55760

high

Tenable Plugins

high

high

high

high