CVE-2026-46581
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.44%
- CWE
- CWE-22, CWE-94, CWE-641
- Published
- 2026-08-05
- Last modified
- 2026-08-05
Affected products
- Eclipse Foundation Eclipse Mojarra
Weakness type
Related vulnerabilities
- CVE-2026-49836 — psd-tools: arbitrary file write via smart-object filename
- CVE-2026-80424 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-45767 — Suricata datasets: save to absolute filename can be bypassed when combined with load command
- CVE-2026-81540 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-81551 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-81554 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82100 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-84889 — A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem