The vulnerability resides in Handlebars.java’s SpringTemplateLoader, where a view name supplied by an attacker can be treated as a file: or classpath: URL with a fragment suffix. The loader strips the .hbs suffix into the URL fragment, causing FileUrlResource.exists() and URL.openStream() to ignore it. Consequently, the untrusted name is passed to handlebars.compile() and the JVM’s ResourceLoader reads the targeted file. An unauthenticated attacker can thus retrieve any file readable by the application’s Java process, compromising confidentiality and potentially enabling further exploitation.

The affected product is Handlebars.java (jknack:handlebars.java). All releases before version 4.5.3 are vulnerable. The issue was fixed in the 4.5.3 release.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this via any request that triggers a controller with a user‑controlled view name, making it feasible for unauthenticated remote actors to read arbitrary files accessible to the JVM.