Handlebars.java prior to version 4.5.5 has a directory traversal flaw that permits an attacker to read files outside the intended template directory. The vulnerability arises in Spring MVC applications that use a file: prefix and allow request‑derived view names. Percent‑encoded traversal sequences such as %2e%2e/ bypass both the view‑resolver containment check and the template loader containment logic, enabling arbitrary local file reads. This can expose sensitive configuration, source code, or other files present on the server hosting the application.

The bug exists in the core handlebars.java library for all releases earlier than 4.5.5. It also affects the handlebars‑springmvc bridge in versions 4.5.3 and 4.5.4 when used with a file: template prefix. The vulnerability is exploitable in Spring MVC applications that resolve view names directly from request parameters, allowing manipulation of the view name to read files beyond the configured template base directory.

The CVSS score is 7.5, indicating a high severity local impact. While no EPSS score is available, the fact that the flaw can be exercised only within a running servlet container and requires the ability to craft a URL targeting the application suggests a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but an attacker with network access to the application or the capability to manipulate URLs can retrieve any file readable by the application process. The attack vector is local to the application server and relies on a crafted request containing percent‑encoded traversal characters.