PT-2026-68120

CVE-2026-46581

Published

2026-08-05

Updated

2026-09-19

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions 2.3 and later

Description URL handling in the DefaultFaceletFactory function does not properly sanitize or block remote URLs. This allows an attacker to specify a URL to a remote Facelet, which the server then includes and processes with its own privileges. This flaw can lead to the unauthorized access of restricted files, such as WEB-INF/web.xml or /etc/passwd.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

CWE-641: Improper Restriction of Names for Files and Other Resources

Related identifiers