Patch 2025.2.14 / CVE

A security advisory has been published for Apache FreeMarker, a template library included in the INFOMOTION Data Management Center (DMC).

CVE-2026-84939 (CVSS 9.1) is a path traversal vulnerability in FreeMarker's template loading mechanism: if an attacker can specify an arbitrary malformed locale identifier while the (by default enabled) localized lookup configuration is active, templates outside their intended directory may be loaded.

Relevance for DMC

DMC uses FreeMarker templates only for generating the DQ-eMail. In that context the templates are maintained by an administrator within the application. Accordingly, the vulnerability can only be triggered by a user with administrator privileges in DMC, not by ordinary users.

Nonetheless, we are now releasing an updated version 2025.2.14 of Data Management Center that includes a patched version of the Apache FreeMarker library.

(since 2025.2.13)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:b6aebda947ab4ed2fbe8709602069bb84ee681ad8804b15b26396e7a0ae8e37f

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.14/dmc.war (sha256: 04606a0a4a8962820dbbc023ff6a3e2333e1572c992d69cc5ee61e65547f0bde)