File disclosure via overwritten render configuration

Information disclosure in PillarJS hbs 4.1.2 and earlier allows remote attackers to read server files via crafted render data. The Express render API accepts attacker-controlled settings and view options alongside template data, allowing a request to replace the views directory and layout filename. Exposure requires a downstream Express application to pass a user-controlled object such as req.query directly to res.render; successful exploitation discloses readable files, not code execution.