As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
Apache FreeMarker versions 2.2.0 through 2.3.34 contain a path traversal vulnerability in the template loading mechanism that can be exploited through a malformed locale parameter. Version 2.3.35 and later address the issue. Both the standard freemarker and freemarker-gae packages are affected.
Why it matters: Teams using FreeMarker for template processing should update to version 2.3.35 or later immediately if they accept user-controlled locale input, as attackers could access arbitrary files on the system.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
CVE-2026-84939 is a path traversal vulnerability in Apache FreeMarker versions 2.2.0 through 2.3.34 that can be exploited if an attacker can specify a malformed locale. The vulnerability affects both the standard freemarker and freemarker-gae packages, with version 2.3.35 confirmed unaffected.
Why it matters: Teams running Apache FreeMarker 2.2.0 through 2.3.34 must upgrade to 2.3.35 or later to prevent attackers who control locale input from traversing the file system through template loading mechanisms.
- Source published
- First seen by Cybersecurity Tracker