CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
Apache FreeMarker CVE-2026-84939 permits path traversal via a malformed locale in template loading; fixed in FreeMarker 2.3.35.
A path traversal vulnerability in Apache FreeMarker's template loading mechanism can be triggered when an attacker controls a malformed locale value. FreeMarker 2.2.0 through 2.3.34 are affected for both the org.freemarker:freemarker and freemarker-gae artifacts, while 2.3.35 is unaffected. No exploitation or CVSS details were included in the announcement.
- Malformed locale input in template loading can lead to path traversal
- Versions 2.2.0 through 2.3.34 affected; upgrade to 2.3.35
- Applies to freemarker and freemarker-gae Maven artifacts
- CVEs
- CVE-2026-84939
- Vendors
- Apache
- Products
- Apache FreeMarker
- Organizations
- ASF
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84939 | Path Traversal in Apache FreeMarker Localized Template Lookup (CVE-2026-84939) | 9.1 | <1% |
From the original article
Posted by Dániel Dékány on Sep 08 Affected versions: - Apache FreeMarker (org. freemarker:freemarker) 2. 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.