CVE Intelligence

Eclipse Foundation Mojarra vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Eclipse Foundation Mojarra: 1 record(s), with affected versions and fixes.
cpe:2.3:a:eclipse:mojarra

CVE-2026-46581 High · 7.5 CWE-22 Aug 5, 2026
Path Traversal in Eclipse Foundation Mojarra
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.