Threat database

A path traversal vulnerability exists in Apache FreeMarker's template loading mechanism when an attacker can specify a malformed locale identifier and localized lookup is enabled (enabled by default). This affects versions from 2.2.0 through 2.3.34. The vulnerability allows unauthorized access to files within the constraints of the configured TemplateLoader. Users should upgrade to version 2.3.35 or disable localized lookup to mitigate the issue.