---
title: "CVE-2026-84939: Apache FreeMarker template loading mechanism vulnerable to path traversal"
url: https://erroneo.us/security/cve/CVE-2026-84939/
description: "CVE-2026-84939 (org.freemarker:freemarker (Maven)): Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-10
date_modified: 2026-09-24
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-84939"
kev: false
cvss: 9.1
epss: 0.00854
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-84939: Apache FreeMarker template loading mechanism vulnerable to path traversal

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.9% , percentile 58: FIRST’s model estimates a 0.9% chance of exploitation activity in the next 30 days, higher than 58% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes org.freemarker:freemarker (Maven) >= 2.2.0, <= 2.3.34, fixed in 2.3.35 . Check your lockfile, including transitive dependencies.

## What it is

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.

## Affected packages

- Maven `org.freemarker:freemarker` >= 2.2.0, <= 2.3.34 → fixed: 2.3.35

## Affected products (CVE record)

- Apache Software Foundation Apache FreeMarker: 2.2.0 <= 2.3.34
- Apache Software Foundation Apache FreeMarker: 2.2.0 <= 2.3.34

## Severity

- CISA-ADP CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.85% probability of exploitation activity in the next 30 days; percentile 58.

## Sources

- [lists.apache.org](https://lists.apache.org/thread/hrd7o2ylwkkswdyhyzllgqt0f80kyd5y)
- [GitHub Advisory GHSA-27j2-h3m2-8237](https://github.com/advisories/GHSA-27j2-h3m2-8237)
- [CVE.org record CVE-2026-84939](https://www.cve.org/CVERecord?id=CVE-2026-84939)
- [NVD entry CVE-2026-84939](https://nvd.nist.gov/vuln/detail/CVE-2026-84939)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/09/08/2)
- [github.com](https://github.com/apache/freemarker/commit/83953d9a9fa5a7c1fce3e39ff57182c19a34b5eb)
- [github.com](https://github.com/apache/freemarker/releases/tag/v2.3.35)

---
Source page: https://erroneo.us/security/cve/CVE-2026-84939/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt