CVE-2026-68536

Name of the Vulnerable Software and Affected Versions Apache MyFaces Core versions prior to 2.3.12 Apache MyFaces Core versions prior to 2.3-next-M9 Apache MyFaces Core versions prior to 3.0.4 Apache MyFaces Core versions prior to 4.0.4 Apache MyFaces Core versions prior to 4.1.4

Description An issue exists that allows Server-Side Request Forgery (SSRF), where an attacker can induce the server to make requests to an unintended location, and Local File Inclusion (LFI), which allows the inclusion of files from the local file system into the application.

Recommendations Upgrade to version 2.3.12. Upgrade to version 2.3-next-M9. Upgrade to version 3.0.4. Upgrade to version 4.0.4. Upgrade to version 4.1.4.