Remote Access Vulnerability in Eclipse Mojarra by Eclipse Foundation

CVE-2026-46581

What is CVE-2026-46581?

In Eclipse Mojarra versions 2.3 and later, a vulnerability exists in how the DefaultFaceletFactory handles URLs. It fails to adequately sanitize or restrict remote URLs, potentially allowing an attacker to inject a malicious URL pointing to a remote Facelet. When processed, this can lead to unauthorized access to sensitive resources within the affected server, such as WEB-INF/web.xml or system files like /etc/passwd, posing significant security risks to applications using Mojarra.

References