Read the docs
TI-2026-34243 Aliases CVE-2026-46581GHSA-wrxx-w58g-3gqp

Path traversal in Eclipse Mojarra

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-22, CWE-94 and the CVSS impact.

Summary

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00556 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 8 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Mojarra2.3 – 5.0—No fix listedCNA
  • Eclipse Mojarra VendorEclipse Foundation Affected 2.3 – 5.0 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:*2.3.0 – 4.1.13VulnerableEclipse Foundation
cpe:2.3:a:eclipse:mojarra:5.0.0:milestone1:*:*:*:*:*:*5.0.0 milestone1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:mojarra:5.0.0:milestone2:*:*:*:*:*:*5.0.0 milestone2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:mojarra:5.0.0:milestone3:*:*:*:*:*:*5.0.0 milestone3VulnerableEclipse Foundation
cpe:2.3:a:eclipse:mojarra:5.0.0:milestone4:*:*:*:*:*:*5.0.0 milestone4VulnerableEclipse Foundation
cpe:2.3:a:eclipse:mojarra:5.0.0:milestone5:*:*:*:*:*:*5.0.0 milestone5VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:* Versions 2.3.0 – 4.1.13 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:mojarra:5.0.0:milestone1:*:*:*:*:*:* Versions 5.0.0 milestone1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:mojarra:5.0.0:milestone2:*:*:*:*:*:* Versions 5.0.0 milestone2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:mojarra:5.0.0:milestone3:*:*:*:*:*:* Versions 5.0.0 milestone3 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:mojarra:5.0.0:milestone4:*:*:*:*:*:* Versions 5.0.0 milestone4 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:mojarra:5.0.0:milestone5:*:*:*:*:*:* Versions 5.0.0 milestone5 Vulnerable ·Eclipse Foundation

Remediation

Red Hat 8 advisories

  • RHSA-2026:70277 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.8.GA com.fasterxml.jackson.core.jackson-core-2.18.9.redhat-00003.jar, com.fasterxml.jackson.core.jackson-databind-2.18.9.redhat-00003.jar, io.netty.netty-codec-4.1.136.Final-redhat-00001.jar +17
  • RHSA-2026:70230 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el10eap +47
  • RHSA-2026:70228 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el8eap +47
Show 5 more Red Hat advisories
  • RHSA-2026:70229 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el9eap +47
  • RHSA-2026:53806 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.25
  • RHSA-2026:53646 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el9eap +47
  • RHSA-2026:53645 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el8eap +47
  • RHSA-2026:53644 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2026:53644
Red Hat JBoss EAP 8.1 for RHEL 10Fixed RHSA-2026:70230
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:70228
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:70229
Red Hat JBoss Enterprise Application Platform 7.4.25Fixed RHSA-2026:53806
Red Hat JBoss Enterprise Application Platform 8.1.8.GAFixed RHSA-2026:70277
Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46581
  2. 2026-10-03 Alias added: GHSA-wrxx-w58g-3gqp
  3. 2026-10-09 Fix available: RHSA-2026:70277 · Red Hat
  4. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  5. 2026-10-21 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.8.GA · Red Hat
  6. 2026-11-01 Affected versions changed · Red Hat

References

Exploit 1

Advisory 1

  • TI-2020-05602 Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary… CVSS 3.1MEDIUM 6.5
  • TI-2018-10313 The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is… CVSS 3.0HIGH 7.5
  • TI-2019-12748 faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences