CVE-2026-46581

HighCVSS 7.5

Published: 05/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

46th percentile - higher than 46% of all known CVEs

Summary

In Eclipse Mojarra versions 2.3 and later, URL handling in DefaultFaceletFactory does not block remote URLs, allowing an attacker to include a remote Facelet processed with server privileges.

Risk Assessment

An attacker can access restricted files such as WEB-INF/web.xml or /etc/passwd, potentially leading to disclosure of sensitive information.

Recommendation

Update Eclipse Mojarra to a patched version or configure blocking of remote URLs in the application.

Other vulnerabilities in Eclipse Mojarra

CVE-2026-120421Medium
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (jakarta.faces.CLIENT_WINDOW_MODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding. h:button renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With com.sun.faces.enableCspNonce=true, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

Original NVD description (English source)

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS