CVE-2026-46581

High

Description

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

SeverityHigh

CVSS7.5

Exploit probability—

ProductEclipse Mojarra

PublishedAug 5, 2026

First seenAug 5, 2026

Weakness typeCWE-22Path traversal CWE-94Code injection CWE-641CWE-641

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
eclipse mojarra	2.3.0 ≤ v ≤ 4.1.13, 5.0.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.