CVE-2026-46581

Summary

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd.

Affected Software

VendorProductVersion RangeStatus
Eclipse FoundationEclipse Mojarra2.3 <= 5.0affected

Weaknesses

  • CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-94: CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-641: CWE-641: Improper Restriction of Names for Files and Other Resources

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

Additional References

References