Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-46581 In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to spe… https://www.cve.org/CVERecord?id=CVE-2026-46581
Post summary
A short disclosure noting that Eclipse Mojarra 2.3+ mishandles remote URLs in DefaultFaceletFactory, enabling potential attacker exploitation.
🚨*CVE* CVE-2026-46581 In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to spe… https://www.cve.org/CVERecord?id=CVE-2026-46581 ----- Traducción: CVE-2026-46581 En … http://infoflow.cloud`
Post summary
CVE‑2026‑46581 is disclosed as a flaw in Eclipse Mojarra’s URL handling that fails to sanitize remote URLs; the post provides no PoC, exploit code, or patch information.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | eclipse | mojarra | - | - | - |
| App | eclipse | mojarra | 5.0.0 | - | - |
| App | eclipse | mojarra | 5.0.0 | - | - |
| App | eclipse | mojarra | 5.0.0 | - | - |
| App | eclipse | mojarra | 5.0.0 | - | - |
| App | eclipse | mojarra | 5.0.0 | - | - |