Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier… (CVE-2026-84939)
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.
AI Analysis
Technical Summary
Apache FreeMarker versions 2.2.0 through 2.3.34 are affected by a path traversal vulnerability (CWE-23) in the template loading mechanism. This occurs if an attacker can specify an arbitrary malformed locale identifier while localized lookup is enabled (default setting). The vulnerability could allow traversal outside the intended template directories, but actual file access is constrained by the TemplateLoader implementation and underlying storage mechanisms. FileTemplateLoader prevents traversal outside its base directory, while other loaders may have different constraints. The issue is fixed in version 2.3.35, and disabling localized lookup in earlier versions also mitigates the risk.
Potential Impact
The vulnerability could allow an attacker to access files outside the intended template directories if localized lookup is enabled and a malformed locale identifier is used. However, the extent of file access is limited by the TemplateLoader configuration and underlying storage constraints. This could lead to unauthorized information disclosure depending on the environment and loader used.
Mitigation Recommendations
Users should upgrade to Apache FreeMarker version 2.3.35 or later, where this vulnerability is fixed. Alternatively, disabling the localized lookup feature in affected versions mitigates the vulnerability. No other immediate actions are required if these mitigations are applied.
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier… (CVE-2026-84939)
Description
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.
Affected software
pkg:maven/org.apache.freemarker/freemarkerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache FreeMarker versions 2.2.0 through 2.3.34 are affected by a path traversal vulnerability (CWE-23) in the template loading mechanism. This occurs if an attacker can specify an arbitrary malformed locale identifier while localized lookup is enabled (default setting). The vulnerability could allow traversal outside the intended template directories, but actual file access is constrained by the TemplateLoader implementation and underlying storage mechanisms. FileTemplateLoader prevents traversal outside its base directory, while other loaders may have different constraints. The issue is fixed in version 2.3.35, and disabling localized lookup in earlier versions also mitigates the risk.
Potential Impact
The vulnerability could allow an attacker to access files outside the intended template directories if localized lookup is enabled and a malformed locale identifier is used. However, the extent of file access is limited by the TemplateLoader configuration and underlying storage constraints. This could lead to unauthorized information disclosure depending on the environment and loader used.
Mitigation Recommendations
Users should upgrade to Apache FreeMarker version 2.3.35 or later, where this vulnerability is fixed. Alternatively, disabling the localized lookup feature in affected versions mitigates the vulnerability. No other immediate actions are required if these mitigations are applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-27j2-h3m2-8237
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-84939"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6aa2af85acd9273b4925b437
Added to database: 09/10/2026, 13:24:21 UTC
Last enriched: 09/10/2026, 14:11:07 UTC
Last updated: 09/10/2026, 16:52:39 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.