Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify
    an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is
    enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users
    are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also
    mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded
    remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular,
    FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other
    TemplateLoader implementations may allow access outside their designated base directory, but they are
    still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader
    can only access resources that the class loader can load, while one wrapping a web application context can
    only access resources available through that context. (CVE-2026-84939)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify     an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is     enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users     are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also     mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded     remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular,     FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other     TemplateLoader implementations may allow access outside their designated base directory, but they are     still constrained by the underlying storage mechanismfor example, a loader wrapping a Java class loader     can only access resources that the class loader can load, while one wrapping a web application context can     only access resources available through that context. (CVE-2026-84939)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461077	Echo: org.freemarker:freemarker: security update to 2.3.35	Tenable Cloud Security	Echo Local Security Checks	Local	critical
461077	Echo: org.freemarker:freemarker: security update to 2.3.35	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
448371	SCA: security update for org.freemarker:freemarker (GHSA-27j2-h3m2-8237)	Tenable Cloud Security	SCA Checks	Local	critical
448371	SCA: security update for org.freemarker:freemarker (GHSA-27j2-h3m2-8237)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
344903	Linux Distros Unpatched Vulnerability : CVE-2026-84939	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-84939

critical

Tenable Plugins

critical

critical

critical

critical

critical