CVE-2026-84939: Apache FreeMarker Path Traversal Vulnerability

CVE-2026-84939 Overview

CVE-2026-84939 is a path traversal vulnerability [CWE-23] in the Apache FreeMarker template engine. The flaw resides in the template loading mechanism when localized lookup is enabled, which is the default configuration. An attacker who can supply an arbitrary malformed locale identifier to FreeMarker can manipulate the lookup path used to resolve templates. The issue affects Apache FreeMarker versions 2.2.0 through 2.3.34. Apache addressed the vulnerability in version 2.3.35. The scope of files reachable through the flaw remains bounded by the configured TemplateLoader. For example, FileTemplateLoader restricts access to the baseDir supplied at construction time, and class loader or web application context loaders are limited to resources those mechanisms expose.

Critical Impact
Attackers supplying malformed locale identifiers can traverse template lookup paths and load unintended templates within the boundaries enforced by the configured TemplateLoader.

Affected Products

Apache FreeMarker 2.2.0 through 2.3.34
Applications using FreeMarker with the default localized_lookup setting enabled
Java applications that pass user-controlled locale values to FreeMarker template resolution

Discovery Timeline

2026-09-10 - CVE-2026-84939 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-84939

Vulnerability Analysis

Apache FreeMarker resolves templates using a localized lookup strategy when the localized_lookup configuration setting is enabled. During lookup, FreeMarker derives candidate template names by appending locale-derived suffixes to the base template name. The vulnerability occurs because the engine does not properly validate malformed locale identifiers before incorporating them into the lookup path. An attacker who controls the locale value passed to FreeMarker can inject path traversal sequences into the constructed template name. The engine then requests these attacker-shaped names from the underlying TemplateLoader.

Successful exploitation depends on the TemplateLoader in use. FileTemplateLoader blocks traversal outside its configured baseDir, limiting exposure. Loaders that wrap Java class loaders or web application contexts remain constrained by the resource visibility of those mechanisms. Even so, attackers may access templates and resources they were not intended to load, potentially disclosing sensitive server-side templates or triggering unintended template rendering.

Root Cause

The root cause is insufficient validation of locale identifier input during localized template lookup [CWE-23]. FreeMarker treats the locale string as trusted when composing template lookup names, allowing traversal characters embedded in a malformed locale to alter the resolved path.

Attack Vector

The attacker must be able to influence the locale identifier consumed by FreeMarker. This typically occurs in web applications that derive the FreeMarker locale from HTTP request headers, query parameters, or user profile data without validation. When the application forwards an attacker-controlled locale to Configuration.getTemplate(name, locale) or an equivalent API, the malformed identifier is processed through the localized lookup logic and reaches the template loader with traversal payloads embedded.

No verified public exploit code is available. Refer to the Apache Mailing List Thread and the Openwall OSS-Security Update for advisory details.

Detection Methods for CVE-2026-84939

Indicators of Compromise

HTTP requests containing Accept-Language headers or locale parameters with path traversal sequences such as ../ or encoded variants
Application logs recording FreeMarker template lookups for unexpected template names outside the standard template directory
TemplateNotFoundException entries in application logs correlating with anomalous locale values
Access attempts to internal template files that are not part of any user-facing route

Detection Strategies

Inspect application logs for FreeMarker getTemplate calls where the derived locale contains characters outside the RFC 5646 language tag grammar
Deploy web application firewall rules that reject locale-carrying inputs containing .., /, \, or URL-encoded traversal sequences
Instrument the FreeMarker TemplateLoader implementation to log the final resolved template path and alert on paths containing traversal segments

Monitoring Recommendations

Monitor for spikes in FreeMarker template resolution failures that correlate with unusual Accept-Language values
Track outbound template rendering of resources not enumerated in the application's template inventory
Correlate anomalous locale inputs with source IP reputation and session context to identify probing activity

How to Mitigate CVE-2026-84939

Immediate Actions Required

Upgrade Apache FreeMarker to version 2.3.35 or later across all Java applications that embed the library
Audit application code for locations where user-controlled input flows into the locale parameter of FreeMarker APIs
Enforce strict locale validation at the application boundary, rejecting any input that does not conform to RFC 5646 language tags

Patch Information

Apache recommends upgrading to Apache FreeMarker version 2.3.35, which contains the fix for CVE-2026-84939. Update the FreeMarker dependency in Maven, Gradle, or equivalent build configurations and redeploy affected applications. Review the Apache Mailing List Thread for the official announcement.

Workarounds

Disable localized lookup by setting Configuration.setLocalizedLookup(false) if upgrading immediately is not feasible
Restrict the TemplateLoader to FileTemplateLoader with a tightly scoped baseDir that contains no sensitive resources
Normalize and validate all locale values against an allowlist before passing them to FreeMarker

bash

# Configuration example: disable localized lookup in Java code
# Configuration cfg = new Configuration(Configuration.VERSION_2_3_34);
# cfg.setLocalizedLookup(false);