What is GHSA-wrxx-w58g-3gqp?

GHSA-wrxx-w58g-3gqp is a security advisory published by GitHub Security Advisories with High severity. In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not...

Which CVE IDs does GHSA-wrxx-w58g-3gqp cover?

GHSA-wrxx-w58g-3gqp covers the following CVE IDs: CVE-2026-46581. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wrxx-w58g-3gqp?

GHSA-wrxx-w58g-3gqp has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-wrxx-w58g-3gqpHighCVSS 7.5

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-46581 →

📋 Description

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-46581
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/160
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/544
https://github.com/advisories/GHSA-wrxx-w58g-3gqp