Description

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-10T06:17:06.460Z",
  "pubdate": "2026-09-10T06:17:06.460Z",
  "executiveSummary": "Apache FreeMarker is susceptible to a path traversal vulnerability impacting versions 2.2.0 through 2.3.34.\nThe vulnerability arises from improper validation of locale identifiers when the localized lookup configuration setting is enabled, a feature active by default.\nAn attacker capable of influencing the locale parameter can potentially traverse file paths beyond the intended template directory.\nThe impact is constrained by the security boundaries of the configured TemplateLoader, such as the base directory restrictions in FileTemplateLoader or the resource access limits of ClassLoader-based loaders.\nThe vulnerability poses a risk of unauthorized information disclosure, as attackers may attempt to access sensitive files or templates if the underlying storage mechanism permits access outside the intended scope.\nExploitation requires the attacker to supply a crafted, malformed locale string to the template loading mechanism.\nUsers are advised to upgrade to version 2.3.35 or disable the localized lookup configuration to remediate this risk.",
  "technicalDetails": "The vulnerability exists within the template loading mechanism of Apache FreeMarker. When the 'localized_lookup' setting is enabled, FreeMarker attempts to locate templates by appending locale-specific suffixes to the template name. The flaw occurs because the library fails to sufficiently sanitize or validate the locale identifier provided by the user before incorporating it into the path resolution process.\nSpecifically, an attacker can supply a malformed locale string containing directory traversal sequences (e.g., '../'). If the system processes this input, the path resolution logic may inadvertently resolve these sequences, allowing the underlying file system or resource loader to access files outside the designated template root directory.\nThe exploitation flow begins when an application uses a TemplateLoader to fetch a template, while simultaneously accepting user-controlled input for the locale. By injecting traversal characters into the locale parameter, the attacker alters the path construction logic. For example, if FreeMarker constructs a path by combining the base template path, the locale, and the file extension, the inclusion of '/../' sequences effectively escapes the base path directory.\nWhile the vulnerability allows for path traversal, the scope of the potential impact is strictly bounded by the implementation of the TemplateLoader. If the application utilizes the FileTemplateLoader, the implementation explicitly includes checks to prevent traversal outside the 'baseDir' constructor argument, which serves as a significant security control. However, custom or alternative TemplateLoader implementations—such as those wrapping class loaders or web application contexts—may lack equivalent restrictions, potentially exposing a broader range of resources or files within the application's environment.\nThis issue affects all versions of Apache FreeMarker from 2.2.0 up to and including 2.3.34. There is no specific authentication or privilege requirement for the exploitation itself, as it depends on the ability to interact with the template loading mechanism. The network exposure is determined by the specific application's deployment and how it exposes template selection or locale settings to end-users. Post-exploitation, the primary impact is unauthorized file access, which could lead to the exposure of sensitive template content or internal configuration files, depending on the accessibility of those files to the process running the FreeMarker engine."
}