bars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This vulnerability permits an attacker to include traversal characters such as "../" or forward slashes in the template name, causing the loader to resolve to an arbitrary file on the filesystem. The file contents are then returned in the rendered template, enabling disclosure of sensitive files or configuration data. This flaw is evaluated with a CVSS score of 7.5.

The vulnerability affects all releases of jknack Handlebars.java earlier than version 4.5.2 that use FileTemplateLoader or ClassPathTemplateLoader to compile templates from names that can be influenced by user input. Application developers who supply template names derived from URL parameters, form fields, or other externally controllable sources are at risk. Systems that use hard‑coded template names or omit the described loaders are not affected.

The CVSS score of 7.5 marks the flaw as high severity, but the EPSS score of less than 1 % and the that public exploitation is unlikely at present. Nevertheless, the flaw can be triggered remotely by sending a request that includes a traversal string as the template name. Once invoked, the loader delivers the contents of the targeted file back to the application’s response, exposing confidential data. An attacker with firewall access to the application network could exercise this vector without needing elevated privileges on the host beyond those granted to the Java process.