Apache FreeMarker template loading mechanism vulnerable to path traversal
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.
GHSA-27j2-h3m2-8237
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-27j2-h3m2-8237
org.freemarker:freemarker
Source reference: /affected/0/package/name
- Affected versions
- 2.3.10
Source reference:
/affected/0/versions2.3.11Source reference:
/affected/0/versions2.3.12Source reference:
/affected/0/versions2.3.13Source reference:
/affected/0/versions2.3.14Source reference:
/affected/0/versions2.3.15Source reference:
/affected/0/versions2.3.16Source reference:
/affected/0/versions2.3.17Source reference:
/affected/0/versions2.3.18Source reference:
/affected/0/versions2.3.19Source reference:
/affected/0/versions2.3.20Source reference:
/affected/0/versions2.3.21Source reference:
/affected/0/versions2.3.22Source reference:
/affected/0/versions2.3.23Source reference:
/affected/0/versions2.3.24-incubatingSource reference:
/affected/0/versions2.3.25-incubatingSource reference:
/affected/0/versions2.3.26-incubatingSource reference:
/affected/0/versions2.3.27-incubatingSource reference:
/affected/0/versions2.3.28Source reference:
/affected/0/versions2.3.29Source reference:
/affected/0/versions2.3.30Source reference:
/affected/0/versions2.3.31Source reference:
/affected/0/versions2.3.32Source reference:
/affected/0/versions2.3.33Source reference:
/affected/0/versions2.3.34Source reference:
/affected/0/versions2.3.9Source reference:
/affected/0/versions - Fixed versions
- 2.3.35
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.3.35"
}
]
}
],
"package": {
"name": "org.freemarker:freemarker",
"purl": "pkg:maven/org.freemarker/freemarker",
"ecosystem": "Maven"
},
"versions": [
"2.3.10",
"2.3.11",
"2.3.12",
"2.3.13",
"2.3.14",
"2.3.15",
"2.3.16",
"2.3.17",
"2.3.18",
"2.3.19",
"2.3.20",
"2.3.21",
"2.3.22",
"2.3.23",
"2.3.24-incubating",
"2.3.25-incubating",
"2.3.26-incubating",
"2.3.27-incubating",
"2.3.28",
"2.3.29",
"2.3.30",
"2.3.31",
"2.3.32",
"2.3.33",
"2.3.34",
"2.3.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-27j2-h3m2-8237/GHSA-27j2-h3m2-8237.json",
"last_known_affected_version_range": "<= 2.3.34"
}
}
]- Related CVEs
- CVE-2026-84939
Source reference:
/aliases
Publisher severity
critical
Source reference: /database_specific/severity
- Event
- #14222 · Revision 1
- Added to Heist Feed
- Publisher date