External risk intelligence

Apache FreeMarker Path Traversal via Malformed Locale

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-84939

Apache FreeMarker is a library, not a standalone service. Reachability depends on whether an application accepts user input for locale identifiers and uses a TemplateLoader implementation susceptible to traversal. While localized lookup is enabled by default, most standard loaders like FileTemplateLoader include built-in protections that limit the scope of potential exploitation.

Path Traversal

Apache Freemarker

2.2 to before 2.3.35

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a vulnerability in how Apache FreeMarker, a widely used template engine, processes locale information. If an attacker can manipulate the specified locale, it could allow them to access or modify files beyond their intended scope, depending on how the FreeMarker template loader is configured. The main concern at this stage is to confirm if your applications use FreeMarker in a way that could be exposed.

Path traversal in FreeMarker template loading.
Matters if applications use FreeMarker with custom locales.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing a specially crafted locale identifier to an application using Apache FreeMarker. If the application has enabled FreeMarker's localized lookup feature, this could allow the attacker to load arbitrary files, potentially leading to the disclosure of sensitive information or the modification of templates. The extent of this access depends on the specific template loader configured within FreeMarker.

Entry condition: Application uses FreeMarker with localized lookup enabled.
Trigger point: Attacker specifies malformed locale identifier.
Resulting risk: Arbitrary file access.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability in Apache FreeMarker could allow an attacker to access sensitive files on the server when the localized lookup configuration is enabled, which is the default. This could occur if an application allows user-specified locale identifiers and uses a TemplateLoader implementation that does not restrict access outside its designated base directory. The actual files accessible are constrained by the specific TemplateLoader and underlying storage mechanism.

System files could be exposed.
Arbitrary locale input could trigger traversal.
Unauthorized access to server files.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts applications using Apache FreeMarker with the localized lookup setting enabled, particularly when arbitrary locale identifiers can be specified. Application owners, in coordination with infrastructure and security teams, should first identify deployments of FreeMarker, confirm if the affected functionality is exposed to external input, and assess business criticality. Subsequent actions will depend on the exposure and an agreement on remediation timelines, potentially involving vendor coordination if a third-party application is affected.

Application owners should investigate FreeMarker usage.
Verify external input to locale identifiers.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache FreeMarker and how is it used?

Apache FreeMarker is a Java-based template engine. Developers use it to generate text output—such as HTML web pages, configuration files, or emails—by combining static templates with dynamic data at runtime. It functions as a library within larger applications rather than a standalone service, meaning it relies on the host application to define how and where it loads the templates it processes.

What is the vulnerability in CVE-2026-84939?

This CVE involves a Path Traversal weakness, categorized as CWE-23. It occurs when the software incorrectly handles file paths during template loading. In this instance, the flaw exists within the mechanism that searches for templates based on language or region settings, known as localized lookup. If an attacker submits a malformed locale identifier, the system might be tricked into accessing files outside the intended template directory.

How can an attacker trigger this path traversal?

An attacker triggers this by supplying a crafted, malicious locale identifier to an application that processes user input for template localization. However, this does not grant unrestricted access to the entire server. The ability to read files remains constrained by the specific TemplateLoader being used. For example, standard loaders like FileTemplateLoader include native safeguards that prevent the engine from escaping its designated base directory.

Do I need to worry if my application uses FreeMarker?

According to Halo Surface Signal, this depends on your specific implementation. While the issue exists in the library, successful exploitation requires that your application accepts user-controlled locale input and uses a TemplateLoader that lacks the standard protections found in default configurations. You should prioritize assessing applications where user-supplied data directly influences the locale configuration.

How should I respond to CVE-2026-84939?

The primary recommendation is to update to Apache FreeMarker version 2.3.35, which addresses the flaw. If an immediate update is not feasible, you can mitigate the risk by disabling the localized lookup feature within your FreeMarker configuration. Start by auditing your environment to identify which applications utilize FreeMarker and determine if they are configured to accept arbitrary locale identifiers from external sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.