A path traversal and arbitrary file read vulnerability exists in Handlebars.java prior to version 4.5.3. The SpringTemplateLoader component resolves attacker-influenced Spring MVC view names via Spring ResourceLoader without proper path-containment validation. By crafting a view name using file: or classpath: URLs with a # fragment delimiter, an attacker can bypass the .hbs suffix appended by the loader, as FileUrlResource.exists() and URL.openStream() discard the fragment portion. HandlebarsViewResolver then passes the attacker-controlled name to handlebars.compile(), enabling unauthenticated remote attackers to read arbitrary files accessible to the JVM. Exploitation requires the application to expose a controller that accepts user-influenced view names. The vulnerability is fixed in Handlebars.java version 4.5.3.
