Server-Side EL Injection Vulnerability in OmniFaces Library
CVE-2026-41883

8.1HIGH

Key Information:

Vendor

Omnifaces

Status
Omnifaces
Vendor
CVE Published:
8 May 2026

What is CVE-2026-41883?

The OmniFaces utility library is susceptible to a server-side EL injection vulnerability that enables remote code execution. This is particularly relevant to applications employing the CDNResourceHandler with wildcard CDN mappings. An attacker can exploit this flaw by crafting a specially designed resource request URL that includes an EL expression in the resource name, which is then evaluated by the server. This poses significant security risks as it allows unauthorized remote code execution. The vulnerability has been addressed in subsequent releases: 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.

Affected Version(s)

omnifaces < 1.14.2 < 1.14.2

omnifaces >= 2.0-RC1, < 2.7.32 < 2.0-RC1, 2.7.32

omnifaces >= 3.0-RC1, < 3.14.16 < 3.0-RC1, 3.14.16

References

https://github.com/omnifaces/omnifaces/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.