This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-46581 | BDVDB-2026-355460 Detail

Eclipse FoundationEclipse Mojarra

Description#

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

Impact#

CAPEC-253: Remote Code Inclusion

Weaknesses#

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-94 Improper Control of Generation of Code ('Code Injection')
  • CWE-641 Improper Restriction of Names for Files and Other Resources

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.