Threats affecting pkg:maven/Apache Software Foundation/org.freemarker:freemarker-gae

CVE-2026-84939 is a critical path traversal vulnerability in Apache FreeMarker's template loading mechanism. It occurs when an attacker specifies a malformed locale identifier while localized lookup is enabled (enabled by default). This affects versions from 2.2.0 through 2.3.34. The vulnerability allows unauthorized reading of files within the constraints of the configured TemplateLoader. Users should upgrade to version 2.3.35 or disable localized lookup to mitigate the issue.