Security Advisory: CVE-2026-84939 – Apache FreeMarker Path Traversal Vulnerability

Date Published: 2026-09-25

CVE Reference: CVE-2026-84939 (GitHub advisory GHSA-27j2-h3m2-8237)

Component: Apache FreeMarker

Affected: Apache FreeMarker 2.2.0 through 2.3.34

Fixed: Apache FreeMarker 2.3.35

Skyve: Fix included in the upcoming Skyve 10 release; mitigations available for Skyve 9.x

Summary

CVE-2026-84939 is a path traversal vulnerability in Apache FreeMarker, the template library Skyve uses to generate reports. If an attacker can supply a malformed locale (language) identifier to FreeMarker, and FreeMarker's localised template lookup is enabled (the default), they may be able to load resources outside the intended template folder.

The vulnerability is rated Critical (CVSS 9.1). It affects FreeMarker versions 2.2.0 through 2.3.34 and is fixed in 2.3.35.

Skyve Impact

Our review found no direct way to trigger this issue through normal report requests that use trusted templates. Skyve applications may be exposed if they:

  • allow untrusted users to create or edit report templates, or
  • include custom code that passes a user-supplied locale or language setting to FreeMarker.

We have not demonstrated an exploit against Skyve. The actual risk depends on how your application is configured and customised.

Skyve 10

The upcoming Skyve 10 release will include FreeMarker 2.3.35, which fixes this issue. We do not yet have a release date and will announce it here on the blog.

Skyve 9.x

For applications on Skyve 9.x, until you can upgrade to Skyve 10, we recommend:

  • Restrict template editing

    Only allow trusted users to create or edit report templates.

  • Don't pass user-supplied locales to FreeMarker

    Review any custom reporting code for places where a locale or language value from a request, parameter or user field is passed to FreeMarker. Validate it against a fixed list of supported locales, or don't pass it at all.

  • Disable localised lookup (optional)

    The FreeMarker project advises that disabling localised lookup also mitigates this vulnerability in affected versions. Note that this stops FreeMarker from automatically choosing locale-specific template variants (for example report_en_AU.ftl), so check that your application doesn't rely on them.

Need Help?

If you're unsure whether your application is affected, contact the Skyve team via GitHub or Slack, or contact Biz Hub through your usual support channel.

Ben PetitosecurityComment