diff --git a/CHANGES b/CHANGES
index fbc73801f..e3c54bfc8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,15 @@
 Babel Changelog
 ===============
 
+Version 2.9.1
+-------------
+
+Bugfixes
+~~~~~~~~
+
+* The internal locale-data loading functions now validate the name of the locale file to be loaded and only
+  allow files within Babel's data directory.  Thank you to Chris Lyne of Tenable, Inc. for discovering the issue!
+
 Version 2.9.0
 -------------
 
diff --git a/LICENSE b/LICENSE
index 7e2f12e46..693e1a187 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2013-2020 by the Babel Team, see AUTHORS for more information.
+Copyright (c) 2013-2021 by the Babel Team, see AUTHORS for more information.
 
 All rights reserved.
 
diff --git a/babel/__init__.py b/babel/__init__.py
index ecb18b546..3e20e4bd1 100644
--- a/babel/__init__.py
+++ b/babel/__init__.py
@@ -13,7 +13,7 @@
        access to various locale display names, localized number and date
        formatting, etc.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
@@ -21,4 +21,4 @@
     negotiate_locale, parse_locale, get_locale_identifier
 
 
-__version__ = '2.9.0'
+__version__ = '2.9.1'
diff --git a/babel/core.py b/babel/core.py
index a0c35b4ea..a323a7295 100644
--- a/babel/core.py
+++ b/babel/core.py
@@ -5,7 +5,7 @@
 
     Core locale representation and locale data access.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/dates.py b/babel/dates.py
index d62d00ba4..75e8f3501 100644
--- a/babel/dates.py
+++ b/babel/dates.py
@@ -12,7 +12,7 @@
      * ``LC_ALL``, and
      * ``LANG``
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/lists.py b/babel/lists.py
index e0bd7ed7f..8368b27a6 100644
--- a/babel/lists.py
+++ b/babel/lists.py
@@ -11,7 +11,7 @@
      * ``LC_ALL``, and
      * ``LANG``
 
-    :copyright: (c) 2015-2020 by the Babel Team.
+    :copyright: (c) 2015-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/localedata.py b/babel/localedata.py
index 782b7afa0..438afb643 100644
--- a/babel/localedata.py
+++ b/babel/localedata.py
@@ -8,7 +8,7 @@
     :note: The `Locale` class, which uses this module under the hood, provides a
            more convenient interface for accessing the locale data.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/localtime/__init__.py b/babel/localtime/__init__.py
index 8c9203a7b..bd3954951 100644
--- a/babel/localtime/__init__.py
+++ b/babel/localtime/__init__.py
@@ -6,7 +6,7 @@
     Babel specific fork of tzlocal to determine the local timezone
     of the system.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/messages/__init__.py b/babel/messages/__init__.py
index 77c79621b..7d2587f63 100644
--- a/babel/messages/__init__.py
+++ b/babel/messages/__init__.py
@@ -5,7 +5,7 @@
 
     Support for ``gettext`` message catalogs.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/messages/catalog.py b/babel/messages/catalog.py
index af1b6573c..a19a3e6d8 100644
--- a/babel/messages/catalog.py
+++ b/babel/messages/catalog.py
@@ -5,7 +5,7 @@
 
     Data structures for message catalogs.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/messages/checkers.py b/babel/messages/checkers.py
index 29add9fce..cba911d72 100644
--- a/babel/messages/checkers.py
+++ b/babel/messages/checkers.py
@@ -7,7 +7,7 @@
 
     :since: version 0.9
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/messages/extract.py b/babel/messages/extract.py
index 8f53fa298..64497762c 100644
--- a/babel/messages/extract.py
+++ b/babel/messages/extract.py
@@ -13,7 +13,7 @@
     The main entry points into the extraction functionality are the functions
     `extract_from_dir` and `extract_from_file`.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/messages/frontend.py b/babel/messages/frontend.py
index 0b65a7c6b..c5eb1dea9 100644
--- a/babel/messages/frontend.py
+++ b/babel/messages/frontend.py
@@ -5,7 +5,7 @@
 
     Frontends for the message extraction functionality.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 from __future__ import print_function
diff --git a/babel/messages/jslexer.py b/babel/messages/jslexer.py
index f56c80d98..c57b1213f 100644
--- a/babel/messages/jslexer.py
+++ b/babel/messages/jslexer.py
@@ -6,7 +6,7 @@
     A simple JavaScript 1.5 lexer which is used for the JavaScript
     extractor.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 from collections import namedtuple
diff --git a/babel/messages/mofile.py b/babel/messages/mofile.py
index 1ab3e4e9c..8d3cfc905 100644
--- a/babel/messages/mofile.py
+++ b/babel/messages/mofile.py
@@ -5,7 +5,7 @@
 
     Writing of files in the ``gettext`` MO (machine object) format.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/messages/plurals.py b/babel/messages/plurals.py
index 4755cfcf9..91ba9e1b1 100644
--- a/babel/messages/plurals.py
+++ b/babel/messages/plurals.py
@@ -5,7 +5,7 @@
 
     Plural form definitions.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/messages/pofile.py b/babel/messages/pofile.py
index b8cb46976..be33b831d 100644
--- a/babel/messages/pofile.py
+++ b/babel/messages/pofile.py
@@ -6,7 +6,7 @@
     Reading and writing of files in the ``gettext`` PO (portable object)
     format.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/numbers.py b/babel/numbers.py
index 0303f0542..0fcc07e15 100644
--- a/babel/numbers.py
+++ b/babel/numbers.py
@@ -12,7 +12,7 @@
      * ``LC_ALL``, and
      * ``LANG``
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 # TODO:
diff --git a/babel/plural.py b/babel/plural.py
index 3c9a3e614..e705e9b8d 100644
--- a/babel/plural.py
+++ b/babel/plural.py
@@ -5,7 +5,7 @@
 
     CLDR Plural support.  See UTS #35.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 import re
diff --git a/babel/support.py b/babel/support.py
index d6fc56cfb..4be9ed37f 100644
--- a/babel/support.py
+++ b/babel/support.py
@@ -8,7 +8,7 @@
 
     .. note: the code in this module is not used by Babel itself
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/babel/util.py b/babel/util.py
index a5d40c5de..a8fbac1d9 100644
--- a/babel/util.py
+++ b/babel/util.py
@@ -5,7 +5,7 @@
 
     Various utility classes and functions.
 
-    :copyright: (c) 2013-2020 by the Babel Team.
+    :copyright: (c) 2013-2021 by the Babel Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/docs/conf.py b/docs/conf.py
index 1c21c67cc..962792fbd 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -44,7 +44,7 @@
 
 # General information about the project.
 project = u'Babel'
-copyright = u'2020, The Babel Team'
+copyright = u'2021, The Babel Team'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
@@ -53,7 +53,7 @@
 # The short X.Y version.
 version = '2.9'
 # The full version, including alpha/beta/rc tags.
-release = '2.9.0'
+release = '2.9.1'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
diff --git a/scripts/dump_data.py b/scripts/dump_data.py
index 57439b98f..ac295b2d7 100755
--- a/scripts/dump_data.py
+++ b/scripts/dump_data.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/scripts/dump_global.py b/scripts/dump_global.py
index a27b31617..c9e1d3008 100755
--- a/scripts/dump_global.py
+++ b/scripts/dump_global.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/scripts/import_cldr.py b/scripts/import_cldr.py
index 0dbd39369..7876d5208 100755
--- a/scripts/import_cldr.py
+++ b/scripts/import_cldr.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/messages/test_catalog.py b/tests/messages/test_catalog.py
index 2d9e31d00..661999648 100644
--- a/tests/messages/test_catalog.py
+++ b/tests/messages/test_catalog.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/messages/test_checkers.py b/tests/messages/test_checkers.py
index bf813bc05..49abb51b0 100644
--- a/tests/messages/test_checkers.py
+++ b/tests/messages/test_checkers.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/messages/test_extract.py b/tests/messages/test_extract.py
index 38979cd30..ac7f0a642 100644
--- a/tests/messages/test_extract.py
+++ b/tests/messages/test_extract.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/messages/test_frontend.py b/tests/messages/test_frontend.py
index 38165b354..70580215e 100644
--- a/tests/messages/test_frontend.py
+++ b/tests/messages/test_frontend.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/messages/test_mofile.py b/tests/messages/test_mofile.py
index 395b9fb1a..fb672a80c 100644
--- a/tests/messages/test_mofile.py
+++ b/tests/messages/test_mofile.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/messages/test_plurals.py b/tests/messages/test_plurals.py
index 62c770870..5e490f374 100644
--- a/tests/messages/test_plurals.py
+++ b/tests/messages/test_plurals.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/messages/test_pofile.py b/tests/messages/test_pofile.py
index 2db7f6715..be1172a88 100644
--- a/tests/messages/test_pofile.py
+++ b/tests/messages/test_pofile.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/test_core.py b/tests/test_core.py
index 53b9d1875..558322e00 100644
--- a/tests/test_core.py
+++ b/tests/test_core.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/test_dates.py b/tests/test_dates.py
index 8e693d34c..44efa7fbc 100644
--- a/tests/test_dates.py
+++ b/tests/test_dates.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/test_localedata.py b/tests/test_localedata.py
index c852c1b69..735678f80 100644
--- a/tests/test_localedata.py
+++ b/tests/test_localedata.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/test_numbers.py b/tests/test_numbers.py
index 739fd1fb7..11e61d37d 100644
--- a/tests/test_numbers.py
+++ b/tests/test_numbers.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/test_plural.py b/tests/test_plural.py
index 1a9fbe507..bea8115ce 100644
--- a/tests/test_plural.py
+++ b/tests/test_plural.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/test_support.py b/tests/test_support.py
index 456425e3e..a683591dc 100644
--- a/tests/test_support.py
+++ b/tests/test_support.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which
diff --git a/tests/test_util.py b/tests/test_util.py
index dbd6378a0..b29278e00 100644
--- a/tests/test_util.py
+++ b/tests/test_util.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright (C) 2007-2011 Edgewall Software, 2013-2020 the Babel team
+# Copyright (C) 2007-2011 Edgewall Software, 2013-2021 the Babel team
 # All rights reserved.
 #
 # This software is licensed as described in the file LICENSE, which