Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Under these conditions, a view name containing backslash sequences can escape the configured template directory, potentially exposing files that should not be accessible.

Returning a view name derived from untrusted input is an application-level anti-pattern that Spring documentation warns against; applications that do not do so are not affected.