Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Apache FreeMarker template loading mechanism vulnerable to path traversal

Fix availableCritical · CVSS 9.1EPSS 0.85%

Published Sep 10, 2026 · updated Sep 24, 2026

What to do

  1. Upgrade to a fixed version: org.freemarker:freemarker 2.3.35.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.freemarker:freemarker

Vulnerable versions
>= 2.2.0, <= 2.3.34
Fixed in
2.3.35

Check your project: mvn dependency:tree -Dincludes=org.freemarker:freemarker

Sources

CWE-23 Relative Path Traversal

← All critical vulnerabilities