Remote Code Execution

Overview org.glassfish:jakarta.faces is an Oracle's implementation of the JavaServer Faces specification. Affected versions of this package are vulnerable to Remote Code Execution due to path traversal in the resolveURLURL source, String path method of DefaultFaceletFactory, which passes a path...

CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

PT-2026-68120

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions 2.3 and later Description URL handling in the DefaultFaceletFactory function does not properly sanitize or block remote URLs. This allows an attacker to specify a URL to a remote Facelet, which the server then includes...

CVE-2026-46581: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...