CVE-2026-46581

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

cloud.piranha.dist:piranha-dist-micro (>=24.11.0, <=25.6.0), cloud.piranha.extension:piranha-extension-micro (>=24.11.0, <=25.6.0) +68 more potentially affected by CVE-2026-46581 via org.glassfish:jakarta.faces (>=4.0.23, <=4.1.12)

org.glassfish:jakarta.faces MAVEN version =4.0.23, =24.11.0, =24.11.0, =24.11.0, =24.11.0, =25.1.0, =5.0.0, =5.0.0, =1.5.15, =1.5.15, =1.5.15, =11.0.0, =6.12.0, =6.12.2 - org.apache.tomee.bom:tomee-plume-api 11.0.0-m1 - org.apache.tomee:apache-tomee 11.0.0-m1 and more Source cves: CVE-2026-46581...