CVE-2026-84939

What it actually does

Apache FreeMarker 2.2.0 through 2.3.34 performs insufficient sanitization of locale identifiers during localized template lookup (enabled by default). A malformed locale can be interpreted as path components, causing the engine to resolve and load templates or other resources from unintended locations within the configured TemplateLoader. Confidentiality and integrity of loader-reachable content can be affected (CVSS 9.1, C:H/I:H/A:N); availability is not impacted. FileTemplateLoader still cannot traverse outside its constructor baseDir. Classpath, servlet-context, and similar loaders remain bounded by what those backing stores can already read or serve.

Why it matters to the business

Internet-facing or multi-tenant applications that pass user-chosen language or locale into FreeMarker may disclose templates, configuration, or other loader-visible resources, or render an unintended template that changes application output or leaks data. The issue is 24 days old, is not on CISA KEV, is not tied to ransomware, and has no public exploit maturity, but the unauthenticated, network-reachable scoring and default-on setting make patching high priority wherever untrusted locale input reaches the engine. Residual risk after a missed patch is highest for apps using TemplateLoaders more permissive than FileTemplateLoader.

How an attack unfolds

An unauthenticated attacker finds an application on FreeMarker 2.2.0–2.3.34 that forwards a request-controlled locale or language value into template processing with localized lookup still enabled. They submit a malformed locale identifier so FreeMarker’s localized lookup treats that value as extra path segments and loads a template or resource outside the intended locale directory, but still inside the TemplateLoader’s allowed namespace. Success may yield unexpected template content or cause a different template to be rendered. FileTemplateLoader cannot be used to leave its base directory; other loaders cannot exceed classpath or web-context limits. No named threat actors or campaigns are associated, and exploit maturity is none.

How to fix it

Upgrade Apache FreeMarker to 2.3.35 or later in every application and shared library that embeds it. If an immediate upgrade is not possible, disable localized lookup in FreeMarker configuration (the project’s documented mitigation for prior versions) and stop passing untrusted locale or language strings into template loading. Inventory direct and transitive FreeMarker usage, rebuild and redeploy affected artifacts, and keep localized lookup disabled unless a patched version is confirmed.

How to confirm the fix worked

Confirm deployed FreeMarker is 2.3.35 or newer via dependency and binary inventory (Maven/Gradle coordinates, JARs on the classpath). On unpatched builds, verify localized lookup is explicitly disabled in configuration and that locale/language request parameters are not forwarded into template loading. Regression-test template rendering for legitimate locales and confirm attempts to use unexpected locale values no longer resolve templates outside the intended locale directories, without introducing exploit payloads.

Typical attack path

1. Find an application using Apache FreeMarker 2.2.0–2.3.34 that accepts locale or language input and uses it in template loading with localized lookup enabled.
2. Send a request that supplies a malformed locale identifier to that input.
3. Trigger template rendering so localized lookup interprets the identifier as extra path segments.
4. Obtain unintended templates or resources, or cause rendering of an unintended template, remaining inside the TemplateLoader’s allowed scope.
5. Abuse any disclosed content or altered rendering according to the application’s trust in those templates.

How to detect it

There is no public exploit maturity and no named actor activity, so look for reconnaissance and failed or unusual template loads rather than a known implant. Review web and application logs for locale, lang, or language parameters whose values contain parent-directory or extra path-separator characters; FreeMarker and application logs for template-not-found or template-load errors whose resolved paths leave the normal locale directories; and access to unexpected templates or resources immediately after a locale-bearing request. Correlate with user-controlled Accept-Language headers if the app maps them into FreeMarker. On hosts using FileTemplateLoader, unexpected files under the configured base directory are more relevant than attempts to leave that directory. Preserve request logs, template-engine logs, and deployment timestamps around 2026-09-10 onward.

• locale=..
• lang=..
• language=..
• locale=../
• lang=../
• language=../
• _locale=..
• fm_locale=..
• Accept-Language: ../
• template not found
• freemarker.template.TemplateNotFoundException
• freemarker.cache
• localized_lookup
• Configuration.setLocalizedLookup

What your security team should do

• Treat internet-facing FreeMarker 2.2.0–2.3.34 apps that accept locale or language input as high priority even though this CVE is not in KEV and has no known in-the-wild exploitation.
• Upgrade all FreeMarker instances to 2.3.35 or later and redeploy; do not rely on FileTemplateLoader confinement alone.
• If upgrade is delayed, disable localized lookup and reject or strictly validate locale identifiers at the application boundary.
• Hunt software bills of materials and runtime classpaths for org.freemarker / freemarker artifacts in the affected range, including transitive dependencies.
• Add detection for anomalous locale parameters and unexpected template-load paths, then re-scan after remediation.