Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-84939: Apache FreeMarker may load unauthorized files
CVE-2026-84939 · published 1 month ago
Summary
Versions of Apache FreeMarker from 2.2.0 to 2.3.34 can be tricked into reading files outside the intended folder if a specially crafted locale value is used and the default localized lookup setting is left on. This could let an attacker view or use sensitive files that the application’s template loader normally protects. Upgrade to version 2.3.35 or turn off localized lookup in the older versions to stop the risk.
What to do
- Update org.freemarker:freemarker to version 2.3.35.
- Update org.freemarker:freemarker to version 2.3.32-aikido.1.
- Update io.root.org.freemarker:freemarker to version 2.3.32-root.io.1.
- Update apache freemarker to version 2.3.35 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache freemarker | <= 2.3.34 |
| – | apache | freemarker |
>= 2.2, < 2.3.35 cpe:2.3:a:apache:freemarker:*:*:*:*:*:*:*:* |
| Debian:12 | debian | libfreemarker-java | All versions |
| Ubuntu:16.04:LTS | canonical | libfreemarker-java | All versions |
| maven | – | org.freemarker:freemarker |
>= 2.2.0, <= 2.3.34 Fix: upgrade to 2.3.35
|
| Root:Maven | – | org.freemarker:freemarker |
< 2.3.32-aikido.1 Fix: upgrade to 2.3.32-aikido.1
|
| Root:Maven | – | io.root.org.freemarker:freemarker |
< 2.3.32-root.io.1 Fix: upgrade to 2.3.32-root.io.1
|
Original advisory text
Apache FreeMarker template loading mechanism vulnerable to path traversal
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled).
This issue affects Apache FreeMarker from 2.2.0 through 2.3.34.
Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this.
Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.
This issue affects Apache FreeMarker from 2.2.0 through 2.3.34.
Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this.
Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.
References
- http://www.openwall.com/lists/oss-security/2026/09/08/2 Mailing List Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-84939 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-84939 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-84939 Third Party Advisory
- https://lists.apache.org/thread/hrd7o2ylwkkswdyhyzllgqt0f80kyd5y Mailing List Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84939
- https://github.com/apache/freemarker/commit/83953d9a9fa5a7c1fce3e39ff57182c19a34...
- https://github.com/apache/freemarker/releases/tag/v2.3.35
- https://github.com/advisories/GHSA-27j2-h3m2-8237
Severity
9.1
Critical
Type
CWE-23Relative Path Traversal
Timeline
Published10 Sep 2026
Updated9 Oct 2026
First seen10 Sep 2026
Sources
CVE-2026-84939 · NVD
CVE-2026-84939 · MITRE
DEBIAN-CVE-2026-84939 · OSV
UBUNTU-CVE-2026-84939 · OSV
GHSA-27j2-h3m2-8237 · GHSA
Track software like this
Free during beta