{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Important"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84939.json"}],"title":"org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier","tracking":{"current_release_date":"2026-09-18T17:35:48+00:00","generator":{"date":"2026-09-18T17:35:48+00:00","engine":{"name":"Red Hat SDEngine","version":"5.3.21"}},"id":"CVE-2026-84939","initial_release_date":"2026-09-10T05:07:24.045000+00:00","revision_history":[{"date":"2026-09-10T05:07:24.045000+00:00","number":"1","summary":"Initial version"},{"date":"2026-09-17T21:41:05+00:00","number":"2","summary":"Current version"},{"date":"2026-09-18T17:35:48+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"Exploit Intelligence","product":{"name":"Exploit Intelligence","product_id":"exploit_intelligence","product_identification_helper":{"cpe":"cpe:/a:redhat:exploit_intelligence:0"}}}],"category":"product_family","name":"Exploit Intelligence"},{"branches":[{"category":"product_name","name":"Red Hat build of Apache Camel 4 for Quarkus 3","product":{"name":"Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3","product_identification_helper":{"cpe":"cpe:/a:redhat:camel_quarkus:3"}}}],"category":"product_family","name":"Red Hat build of Apache Camel 4 for Quarkus 3"},{"branches":[{"category":"product_name","name":"Red Hat build of Apicurio Registry 3","product":{"name":"Red Hat build of Apicurio Registry 3","product_id":"red_hat_build_of_apicurio_registry_3","product_identification_helper":{"cpe":"cpe:/a:redhat:apicurio_registry:3"}}}],"category":"product_family","name":"Red Hat build of Apicurio Registry 3"},{"branches":[{"category":"product_name","name":"Red Hat Build of Keycloak","product":{"name":"Red Hat Build of Keycloak","product_id":"red_hat_build_of_keycloak","product_identification_helper":{"cpe":"cpe:/a:redhat:build_keycloak:"}}}],"category":"product_family","name":"Red Hat Build of Keycloak"},{"branches":[{"category":"product_name","name":"Red Hat build of Quarkus","product":{"name":"Red Hat build of Quarkus","product_id":"red_hat_build_of_quarkus","product_identification_helper":{"cpe":"cpe:/a:redhat:quarkus:3"}}}],"category":"product_family","name":"Red Hat build of Quarkus"},{"branches":[{"category":"product_name","name":"Red Hat Fuse 7","product":{"name":"Red Hat Fuse 7","product_id":"red_hat_fuse_7","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_fuse:7"}}}],"category":"product_family","name":"Red Hat Fuse 7"},{"branches":[{"category":"product_name","name":"Red Hat Single Sign-On 7","product":{"name":"Red Hat Single Sign-On 7","product_id":"red_hat_single_sign-on_7","product_identification_helper":{"cpe":"cpe:/a:redhat:red_hat_single_sign_on:7"}}}],"category":"product_family","name":"Red Hat Single Sign-On 7"},{"category":"product_version","name":"exploit-intelligence/agent-client-rhel9","product":{"name":"exploit-intelligence/agent-client-rhel9","product_id":"exploit-intelligence/agent-client-rhel9","product_identification_helper":{"purl":"pkg:oci/agent-client-rhel9?repository_url=registry.redhat.io/exploit-intelligence/agent-client-rhel9"}}},{"category":"product_version","name":"freemarker","product":{"name":"freemarker","product_id":"freemarker","product_identification_helper":{"purl":"pkg:maven/org.freemarker/freemarker"}}},{"category":"product_version","name":"rhbk/keycloak-rhel9","product":{"name":"rhbk/keycloak-rhel9","product_id":"rhbk/keycloak-rhel9","product_identification_helper":{"purl":"pkg:oci/keycloak-rhel9?repository_url=registry.redhat.io/rhbk/keycloak-rhel9"}}},{"category":"product_version","name":"freemarker-parser","product":{"name":"freemarker-parser","product_id":"freemarker-parser","product_identification_helper":{"purl":"pkg:npm/freemarker-parser"}}}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"exploit-intelligence/agent-client-rhel9 as a component of Exploit Intelligence","product_id":"exploit_intelligence:exploit-intelligence/agent-client-rhel9"},"product_reference":"exploit-intelligence/agent-client-rhel9","relates_to_product_reference":"exploit_intelligence"},{"category":"default_component_of","full_product_name":{"name":"freemarker as a component of Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3:freemarker"},"product_reference":"freemarker","relates_to_product_reference":"red_hat_build_of_apache_camel_4_for_quarkus_3"},{"category":"default_component_of","full_product_name":{"name":"freemarker as a component of Red Hat build of Apicurio Registry 3","product_id":"red_hat_build_of_apicurio_registry_3:freemarker"},"product_reference":"freemarker","relates_to_product_reference":"red_hat_build_of_apicurio_registry_3"},{"category":"default_component_of","full_product_name":{"name":"freemarker as a component of Red Hat Build of Keycloak","product_id":"red_hat_build_of_keycloak:freemarker"},"product_reference":"freemarker","relates_to_product_reference":"red_hat_build_of_keycloak"},{"category":"default_component_of","full_product_name":{"name":"rhbk/keycloak-rhel9 as a component of Red Hat Build of Keycloak","product_id":"red_hat_build_of_keycloak:rhbk/keycloak-rhel9"},"product_reference":"rhbk/keycloak-rhel9","relates_to_product_reference":"red_hat_build_of_keycloak"},{"category":"default_component_of","full_product_name":{"name":"freemarker as a component of Red Hat build of Quarkus","product_id":"red_hat_build_of_quarkus:freemarker"},"product_reference":"freemarker","relates_to_product_reference":"red_hat_build_of_quarkus"},{"category":"default_component_of","full_product_name":{"name":"freemarker as a component of Red Hat Fuse 7","product_id":"red_hat_fuse_7:freemarker"},"product_reference":"freemarker","relates_to_product_reference":"red_hat_fuse_7"},{"category":"default_component_of","full_product_name":{"name":"freemarker-parser as a component of Red Hat Fuse 7","product_id":"red_hat_fuse_7:freemarker-parser"},"product_reference":"freemarker-parser","relates_to_product_reference":"red_hat_fuse_7"},{"category":"default_component_of","full_product_name":{"name":"freemarker as a component of Red Hat Single Sign-On 7","product_id":"red_hat_single_sign-on_7:freemarker"},"product_reference":"freemarker","relates_to_product_reference":"red_hat_single_sign-on_7"}]},"vulnerabilities":[{"cve":"CVE-2026-84939","cwe":{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},"discovery_date":"2026-09-10T05:30:54.236226+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_build_of_apache_camel_4_for_quarkus_3:freemarker","red_hat_build_of_apicurio_registry_3:freemarker","red_hat_build_of_quarkus:freemarker"]},{"label":"vulnerable_code_cannot_be_controlled_by_adversary","product_ids":["red_hat_build_of_keycloak:freemarker","red_hat_build_of_keycloak:rhbk/keycloak-rhel9"]},{"label":"vulnerable_code_not_in_execute_path","product_ids":["red_hat_fuse_7:freemarker","red_hat_fuse_7:freemarker-parser"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2531282"}],"notes":[{"category":"description","text":"A flaw was found in Apache FreeMarker. A remote attacker could exploit a path traversal vulnerability in the template loading mechanism by providing a specially crafted, malformed locale identifier. This is possible if the localized lookup configuration setting is enabled, which is the default. This vulnerability could allow an attacker to access files outside the intended base directory, potentially leading to information disclosure or unauthorized file access, depending on the configured TemplateLoader.","title":"Vulnerability description"},{"category":"summary","text":"org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier","title":"Vulnerability summary"},{"category":"other","text":"This is an Important path traversal vulnerability in Apache FreeMarker, affecting Red Hat JBoss Fuse, Red Hat Build of Keycloak, and Red Hat Single Sign-On. An attacker can exploit this flaw by providing a malformed locale identifier when localized lookup is enabled by default, potentially accessing restricted files. While FileTemplateLoader limits traversal to its base directory, other TemplateLoader implementations may allow broader access, justifying the Important impact.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_affected":["red_hat_single_sign-on_7:freemarker"],"known_not_affected":["red_hat_build_of_apache_camel_4_for_quarkus_3:freemarker","red_hat_build_of_apicurio_registry_3:freemarker","red_hat_build_of_keycloak:freemarker","red_hat_build_of_keycloak:rhbk/keycloak-rhel9","red_hat_build_of_quarkus:freemarker","red_hat_fuse_7:freemarker","red_hat_fuse_7:freemarker-parser"],"under_investigation":["exploit_intelligence:exploit-intelligence/agent-client-rhel9"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-84939"},{"category":"external","summary":"RHBZ#2531282","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531282"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-84939","url":"https://www.cve.org/CVERecord?id=CVE-2026-84939"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-84939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84939"},{"category":"external","summary":"http://www.openwall.com/lists/oss-security/2026/09/08/2","url":"http://www.openwall.com/lists/oss-security/2026/09/08/2"},{"category":"external","summary":"https://lists.apache.org/thread/hrd7o2ylwkkswdyhyzllgqt0f80kyd5y","url":"https://lists.apache.org/thread/hrd7o2ylwkkswdyhyzllgqt0f80kyd5y"}],"release_date":"2026-09-10T05:07:24.045000+00:00","remediations":[{"category":"none_available","details":"Affected","product_ids":["red_hat_single_sign-on_7:freemarker"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["exploit_intelligence:exploit-intelligence/agent-client-rhel9","red_hat_build_of_apache_camel_4_for_quarkus_3:freemarker","red_hat_build_of_apicurio_registry_3:freemarker","red_hat_build_of_keycloak:freemarker","red_hat_build_of_keycloak:rhbk/keycloak-rhel9","red_hat_build_of_quarkus:freemarker","red_hat_fuse_7:freemarker","red_hat_fuse_7:freemarker-parser","red_hat_single_sign-on_7:freemarker"]}],"threats":[{"category":"impact","details":"Important","product_ids":["exploit_intelligence:exploit-intelligence/agent-client-rhel9","red_hat_build_of_apache_camel_4_for_quarkus_3:freemarker","red_hat_build_of_apicurio_registry_3:freemarker","red_hat_build_of_keycloak:freemarker","red_hat_build_of_keycloak:rhbk/keycloak-rhel9","red_hat_build_of_quarkus:freemarker","red_hat_fuse_7:freemarker","red_hat_fuse_7:freemarker-parser","red_hat_single_sign-on_7:freemarker"]}],"title":"org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier"}]}