CVE-2026-84939 GHSA-27j2-h3m2-8237 freemarker: Path traversal in template loading via malformed locale (2.3.31 -> 2.3.35)

[dependabot]

Bumps org.freemarker:freemarker from 2.3.31 to 2.3.35 (freemarker.version in the root pom.xml), clearing Dependabot alert #324.

Advisory

CVE-2026-84939 / GHSA-27j2-h3m2-8237 — Path traversal (CWE-23) in the FreeMarker template loading mechanism. If an attacker can pass an arbitrary malformed locale identifier to FreeMarker and localized lookup is enabled (the default), the localized template name built from that locale can escape the intended template path. What can be read is still bounded by the configured TemplateLoader: FileTemplateLoader stays inside its baseDir, a class-loader based loader can reach only what the class loader can load, a servlet-context loader only what the web application context exposes. 2.3.35 fixes the lookup (apache/freemarker@83953d9); disabling localized lookup mitigates older versions.

Severity	Critical — CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Affected	org.freemarker:freemarker >= 2.2.0, <= 2.3.34
Fixed in	2.3.35

Impact on OpenAM

Low. FreeMarker ships in the WAR (openam-server-only) and is used by the OAuth2 provider to render its HTML pages (authorization consent, device code verification, form_post response) through org.forgerock.oauth2.restlet.TemplateFactory. That factory builds a single Configuration with a MultiTemplateLoader over Restlet's ContextTemplateLoader("clap:///") and a ClassTemplateLoader, and loads templates with config.getTemplate(name) — i.e. with the configuration's default locale (the JVM default). No request-controlled locale reaches FreeMarker, so the attacker-supplied locale the advisory requires is not available, and both loaders are confined to class-path resources anyway. The Click FreemarkerTemplateService is referenced only in Javadoc. The bump takes the shipped library out of the vulnerable range.

Change

freemarker.version: 2.3.31 → 2.3.35 in the root pom.xml. org.restlet.ext.freemarker already excludes its own FreeMarker, so the managed version is the one that ends up in the WAR. No code or behaviour change.

References

• GHSA-27j2-h3m2-8237
• https://nvd.nist.gov/vuln/detail/CVE-2026-84939
• https://lists.apache.org/thread/hrd7o2ylwkkswdyhyzllgqt0f80kyd5y
• apache/freemarker@83953d9
• https://github.com/apache/freemarker/releases/tag/v2.3.35