CVE-2026-46581

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions 2.3 and later

Description URL handling in the DefaultFaceletFactory function does not properly sanitize or block remote URLs. This allows an attacker to specify a URL to a remote Facelet, which the server then includes and processes with its own privileges. This flaw can lead to the unauthorized access of restricted files, such as WEB-INF/web.xml or /etc/passwd.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.