The vulnerability is a path‑traversal flaw in Apache FreeMarker’s template loading mechanism. By providing an arbitrary malformed locale identifier while the localized lookup configuration is enabled, an attacker can influence file resolution. Depending on the TemplateLoader used, this may allow the attacker to read files outside the intended base directory, exposing configuration files, credentials, or source code. The impact is limited to information disclosure unless the TemplateLoader permits broader access.

Apache FreeMarker versions 2.2.0 through 2.3.34 are affected. The issue is present in releases from Apache Software Foundation that include the default localized lookup feature.

No CVSS score or EPSS value is provided, and the vulnerability is not listed in the CISA KEV catalog. The exploitability depends on the application’s template loader configuration; while FileTemplateLoader confines access to its configured baseDir, other loaders may still expose sensitive files if improperly set up. The likely attack vector is remote request input that supplies the locale value, such as in a web or network-facing application. Given the lack of exploitation statistics, the risk is considered moderate, but organizations should treat it as actionable because of the potential for data exposure.