CVE-2026-46581

Description

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

Traduire en français

Produits concernés

• Eclipse Foundation Eclipse Mojarra
• Eclipse mojarra

Scores CVSS

Faiblesses (CWE)

• CWE-22
• CWE-94
• CWE-641

Références

• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/160 Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/544 ExploitVendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/544 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories