A critical path traversal vulnerability in Apache FreeMarker allows unauthenticated attackers to potentially read or manipulate files outside the intended directory structure.

This flaw is a relative path traversal (CWE-23) triggered when an attacker provides a malformed locale identifier to the template loading mechanism. The vulnerability is exploitable by unauthenticated remote users if the localized lookup configuration remains in its default enabled state.

The vulnerability carries a CVSS score of 9.1, reflecting a critical risk to confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive application files or configuration data, potentially resulting in full system compromise depending on the environment and the specific TemplateLoader implementation in use.

Immediate Action: Upgrade Apache FreeMarker to version 2.3.35 or later to resolve the underlying flaw.

Proactive Monitoring: Review application access logs for suspicious locale strings or requests containing directory traversal sequences, such as dot-dot-slash patterns.

Compensating Controls: If an immediate upgrade is not feasible, disable the localized lookup configuration setting within the FreeMarker environment to mitigate the attack vector.

Public Exploit Available: Unknown

Given the critical CVSS severity and the ease of exploitation over a network, organizations should prioritize patching to version 2.3.35. Administrators must verify their current versioning and, if immediate patching is delayed, ensure that the localized lookup configuration is disabled to prevent potential exploitation.