Vulnpedia
← All CVEs

CVE-2026-84939

CRITICAL 9.1 ALL-YEARS

Published 2026-09-10 · Last modified 2026-09-10 · apache · NVD: Analyzed

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.

ELEVATED IMPACT

Severe if exploited (CVSS 9.1), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.9%chance of exploitation in 30 days · 58th percentile

○ In CISA KEV○ Public exploit / PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

9.1CVSS 3.1 · CRITICAL · ADP

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.

Affected

Vendors Apache Software Foundation Apache

Products Apache Freemarker Freemarker

Weakness (CWE)

  • CWE-23: Relative path traversal

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Known Affected Software Configurations

VendorProductVersion range
ApacheFreemarker≥ 2.2 and < 2.3.35

All CVSS metrics

  • CRITICAL 9.1 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CRITICAL 9.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Advisories

Sources: NVD · CVE.org · EPSS