{"vulnerability": "cve-2026-6349", "sightings": [{"uuid": "d6bf439a-68fb-4f6e-ba19-31654d7984fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6349", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116412503035182529", "content": "", "creation_timestamp": "2026-04-16T04:30:28.846184Z"}, {"uuid": "a3da912a-ba82-4b20-b2ce-70799d717f5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6349", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjln2ddzvz2r", "content": "", "creation_timestamp": "2026-04-16T05:03:26.159241Z"}, {"uuid": "2a5be727-d239-471a-aba2-b545bf50d9a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6349", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10841-4f504-2.html", "content": "", "creation_timestamp": "2026-04-15T18:44:00.000000Z"}, {"uuid": "76053219-7bb0-445f-9543-7c47e4627d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6349", "type": "seen", "source": "Telegram/RpCSTqHfWBqrKG53EyhvOrMVfWJfX1b8PG9fT94i9MHNW6c", "content": "", "creation_timestamp": "2026-04-16T05:18:09.000000Z"}, {"uuid": "4b008a6f-8913-49c8-812b-e5c115def097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63490", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjpvjbeij2o", "content": "\ud83d\udfe0 CVE-2026-63490 - High (7.5)\n\nHandlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, co...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63490/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-20T17:01:03.070823Z"}, {"uuid": "72d6e1e6-48b2-4376-a8f0-5063811a9792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63490", "type": "seen", "source": "https://gist.github.com/alon710/ac9a336078ecd53e84e4088322a7f9af", "content": "# CVE-2026-63490: CVE-2026-63490: Path Traversal and Arbitrary File Disclosure in Handlebars.java\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63490\n\n## Summary\nCVE-2026-63490 is a critical path traversal vulnerability in the Spring MVC integration of Handlebars.java. It allows unauthenticated remote attackers to bypass suffix validation and retrieve arbitrary system files via crafted dynamic view names.\n\n## TL;DR\nUnauthenticated path traversal in Handlebars.java allows arbitrary file retrieval by exploiting a parser discrepancy between Java's URL resolver and template suffix enforcement.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-23, CWE-552\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.0047\n- **Impact**: Arbitrary File Disclosure\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications implementing handlebars-springmvc below version 4.5.3\n- **handlebars-springmvc**: < 4.5.3 (Fixed in: `4.5.3`)\n\n## Mitigation\n\n- Upgrade Handlebars.java dependency to version 4.5.3 or later\n- Refactor controller logic to avoid direct user influence on MVC view names\n- Implement strong input filtering for URL protocols and URL delimiters in controller paths\n\n**Remediation Steps:**\n1. Open the build configuration file (pom.xml or build.gradle).\n2. Locate the dependency for com.github.jknack:handlebars-springmvc.\n3. Update the version string to 4.5.3.\n4. Rebuild and deploy the application.\n5. Ensure view names returned by controllers are resolved against a static, validated list of templates.\n\n## References\n\n- [GitHub Security Advisory GHSA-g29j-rwfv-h99w](https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w)\n- [CVE-2026-63490 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-63490)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63490) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T11:31:46.882222Z"}]}