CVE-2026-41883

HIGH

OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Title source: cna
STIX 2.1

Description

OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0038
EPSS Percentile 29.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-917
Status published
Products (10)
omnifaces/omnifaces < 1.14.2
omnifaces/omnifaces >= 2.0-RC1, < 2.7.32
omnifaces/omnifaces >= 3.0-RC1, < 3.14.16
omnifaces/omnifaces >= 4.0-M1, < 4.7.5
omnifaces/omnifaces >= 5.0-M1, < 5.2.3
org.omnifaces/omnifaces 0 - 1.14.2Maven
org.omnifaces/omnifaces 2.0-RC1 - 2.7.32Maven
org.omnifaces/omnifaces 3.0-RC1 - 3.14.16Maven
org.omnifaces/omnifaces 4.0-M1 - 4.7.5Maven
org.omnifaces/omnifaces 5.0-M1 - 5.2.3Maven
Published May 08, 2026
Tracked Since May 08, 2026