Executive brief
Apache FreeMarker is a widely-used Java template engine that processes text and HTML templates. This vulnerability allows an attacker to read arbitrary files outside the intended template directory by crafting a malicious locale identifier, provided the default localized lookup feature is enabled. Successful exploitation can expose sensitive application files, configuration data, or system information.
Technical details
This is a path traversal vulnerability (CWE-23) in FreeMarker's template loading mechanism. When localized template lookup is enabled (the default configuration), an attacker can supply a crafted malformed locale identifier that bypasses path sanitization and resolves to files outside the base template directory. The vulnerability requires no authentication or user interaction and is reachable over the network if FreeMarker is exposed via a web application. The attacker can read arbitrary files within the constraints of the underlying TemplateLoader implementation—for example, FileTemplateLoader may still restrict access if a baseDir is configured, but other TemplateLoader implementations may be more permissive. Versions 2.2.0 through 2.3.34 are affected; upgrading to 2.3.35 patches the issue, and disabling localized lookup mitigates it in older versions.
Affected products
- Apache FreeMarker 2.2.0 through 2.3.34
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Version 2.3.35 released