CVE-2026-46581: Path Traversal
In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd.
Other sources
original reporting: https://docs.google.com/document/d/1Rf4NtLudECimDNy8F9clUblm6Avx8yF/edit
SSTI/EL Injection — Mojarra ui:include resolveURL honours absolute URL schemes (JBoss EAP)
Unauthenticated remote code execution as the JBoss process owner (root in the default Red Hat container image), for any EAP 7.4.x estate hosting a JSF app with the user-controlled-include pattern. findings/jboss-eap95.md
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46581?
CVE-2026-46581 has a severity rating of 65.
How do I fix CVE-2026-46581?
To fix CVE-2026-46581, upgrade to a patched version of Eclipse Mojarra where the remote URL handling issue is resolved.
What are the risks associated with CVE-2026-46581?
CVE-2026-46581 can lead to code injection and unauthorized remote code execution through improperly sanitized URLs.
Which versions of Eclipse Mojarra are affected by CVE-2026-46581?
Eclipse Mojarra versions 2.3 and following are affected by CVE-2026-46581.
What type of vulnerability is CVE-2026-46581 categorized as?
CVE-2026-46581 is categorized under Path Traversal and Code Injection vulnerabilities.