CVE-2026-46581: eclipse foundation eclipse mojarra Path Traversal

Vulnerability summary

CVE-2026-46581 is a high (CVSS 7.5) Path Traversal vulnerability in eclipse foundation eclipse mojarra. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-08-2026
   PublishedVulnerability first disclosed.
2. 05-08-2026
   Last modifiedVulnerability information updated.

Description

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-641Improper Restriction of Names for Files and Other ResourcesThe product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.