CVE-2026-103088

{
  "etk_id": "ETK-2026-62",
  "cve_id": "CVE-2026-103088",
  "display_id": "CVE-2026-103088",
  "ghsa_id": "GHSA-2m6h-5wp5-qp66",
  "euvd_id": "EUVD-2026-89555",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Directory traversal in handlebars-springmvc",
  "summary": "Handlebars.java's Spring MVC integration in versions 4.5.3 and 4.5.4 can resolve encoded traversal sequences inconsistently when templates are loaded from the filesystem. An attacker may read files outside the configured template directory when a Spring MVC application uses a `file:` template location and accepts request-derived view names.",
  "mitigation": "Upgrade Handlebars.java to version 4.5.5 or later. Until upgraded, avoid filesystem-backed template prefixes and ensure request input cannot influence view names.",
  "vendor": "jknack",
  "product": "handlebars.java",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.3, <= 4.5.4"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "4.5.5"
      ],
      "package_name": "com.github.jknack:handlebars-springmvc",
      "purl": "pkg:maven/com.github.jknack/handlebars-springmvc"
    }
  ],
  "cwes": [
    24
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0069,
  "epss_percentile": 0.5193,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 14.952648383333333,
  "t0_at": "2026-09-30T00:55:19.940000+00:00",
  "signals": {
    "check": {
      "at": "2026-09-30T01:40:23.670801+00:00",
      "days": 0.03129318056712963,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T00:55:19.940000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-30T00:55:19.940000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T00:55:19.940000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103088"
    }
  }
}