{"cve":"CVE-2026-84939","nvd":{"published":"2026-09-10T06:17:06.460","modified":"2026-09-11T13:06:56.423","status":"Analyzed","description":"Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled).\n\nThis issue affects Apache FreeMarker from 2.2.0 through 2.3.34.\n\nUsers are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this.\n\nNote that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-23"],"references":["https://lists.apache.org/thread/hrd7o2ylwkkswdyhyzllgqt0f80kyd5y","http://www.openwall.com/lists/oss-security/2026/09/08/2"],"products":["apache:freemarker"],"source":"nvd","synced_at":"2026-10-19T22:52:53.108888569+00:00"},"epss":{"cve":"CVE-2026-84939","score":0.00854,"percentile":0.58324,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-27j2-h3m2-8237","url":"https://osv.dev/vulnerability/GHSA-27j2-h3m2-8237","summary":"Apache FreeMarker template loading mechanism vulnerable to path traversal","modified":"2026-09-24T19:15:05.725637844Z","packages":[{"ecosystem":"Maven","name":"org.freemarker:freemarker","purl":"pkg:maven/org.freemarker/freemarker","ranges":[">=2.2.0 <2.3.35"],"fixed":["2.3.35"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}