CVE-2026-84939

CriticalCVSS 9.1

Published: 10/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

Path traversal vulnerability in Apache FreeMarker template loading mechanism occurs if an attacker can specify an arbitrary malformed locale identifier and the localized lookup configuration setting is enabled (it's enabled by default). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35; disabling localized lookup in previous versions also mitigates this. Even in affected versions, files that can be loaded remain restricted by the configured TemplateLoader — FileTemplateLoader prevents traversal outside its baseDir, and other implementations are constrained by the underlying storage mechanism (e.g., class loader or web application context).

Risk Assessment

An attacker may read files outside the permitted directory if the configured TemplateLoader allows it, potentially leading to disclosure of sensitive information.

Recommendation

Upgrade Apache FreeMarker to version 2.3.35 or later. Alternatively, disable the localized lookup setting in the configuration.

Other vulnerabilities in Apache FreeMarker

CVE-2026-27851High
A vulnerability in the safe filter causes all subsequent pipelines on the same string to be incorrectly treated as safe after variable expansion, allowing unsafe data to be unescaped. This can enable SQL or LDAP injection attacks, especially in authentication contexts.

Original NVD description (English source)

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.