CVE-2026-41883

OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.

Scoring

Severity

HIGH

CVSS base score

8.1

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.50%

CWE

CWE-917

Published

2026-05-08

Last modified

2026-05-08

Affected products

• omnifaces omnifaces
• omnifaces omnifaces
• omnifaces omnifaces
• omnifaces omnifaces
• omnifaces omnifaces

Weakness type

• CWE-917

Related vulnerabilities

• CVE-2026-65591 — n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
• CVE-2026-11561 — SSTI in Soagen Informatics' Apinizer
• CVE-2026-40985 — Data Binding Vulnerability in Spring Web Flow with Unified EL Parser
• CVE-2026-41729 — Spring Data REST SpEL Injection via Map Key in JSON Patch
• CVE-2026-41719 — Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
• CVE-2026-41717 — Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
• CVE-2026-2586 — An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's...
• CVE-2026-2587 — A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template...

Markdown version · Browse all CVEs