CVE-2026-46581

HIGH

Eclipse Mojarra < 5.0 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: rule

Description

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

References (2)

Core 2

Core References

https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/544

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/160

Scores

CVSS v3 7.5

EPSS 0.0035

EPSS Percentile 27.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-22 CWE-641 CWE-94

Status published

Products (1)

Eclipse Foundation/Eclipse Mojarra 2.3 - 5.0

Published Aug 05, 2026

Tracked Since Aug 05, 2026