CVE-2026-27851

HighCVSS 7.4

Published: 12/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

A vulnerability in the safe filter causes all subsequent pipelines on the same string to be incorrectly treated as safe after variable expansion, allowing unsafe data to be unescaped. This can enable SQL or LDAP injection attacks, especially in authentication contexts.

Risk Assessment

The organization faces the risk of SQL or LDAP injection in authentication processes, potentially leading to unauthorized access to systems and data.

Recommendation

Avoid using the safe filter until a fixed version is released. Once a patch is available, update the system immediately.

Other vulnerabilities in Apache FreeMarker

CVE-2026-84939Critical
Path traversal vulnerability in Apache FreeMarker template loading mechanism occurs if an attacker can specify an arbitrary malformed locale identifier and the localized lookup configuration setting is enabled (it's enabled by default). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35; disabling localized lookup in previous versions also mitigates this. Even in affected versions, files that can be loaded remain restricted by the configured TemplateLoader — FileTemplateLoader prevents traversal outside its baseDir, and other implementations are constrained by the underlying storage mechanism (e.g., class loader or web application context).

Original NVD description (English source)

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.