Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrap
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Apache FreeMarker versions 2.2.0 through 2.3.34 contain a critical path traversal vulnerability (CVE-2026-84939, CVSS 9.1) in their template loading mechanism. When localized lookup is enabled—the default configuration—attackers can craft malformed locale identifiers to traverse directory boundaries and access arbitrary files on the system. This affects any application using vulnerable FreeMarker versions for template processing, particularly those handling user-controlled locale parameters. The vulnerability is particularly dangerous because it requires no authentication and exploits a fundamental feature enabled by default, making it trivially exploitable in many real-world deployments.
While this CVE currently maps to zero Casky skills (reflecting the emerging nature of this vulnerability), practitioners can detect exploitation attempts by monitoring for suspicious patterns in template loading and file access behaviors. Security teams should implement detection around: (1) unusual locale parameter values containing path traversal sequences like '../' or encoded variants, (2) unexpected file system access attempts originating from template processing contexts, and (3) configuration analysis confirming localized lookup status. Organizations using FreeMarker should immediately upgrade to version 2.3.35 or disable localized lookup in earlier versions. As threat intelligence matures around this CVE, Casky's skills library will expand to include specific detection and response patterns mapped to relevant MITRE ATT&CK techniques such as T1083 (File and Directory Discovery) and T1087 (Account Discovery).
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-84939. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation