CVE-2026-46581 Overview
CVE-2026-46581 affects Eclipse Mojarra versions 2.3 and later. The DefaultFaceletFactory class does not properly sanitize or block remote URLs during Facelet resolution. An attacker can supply a URL pointing to a remote Facelet that the server fetches and processes with its own privileges. This behavior enables unauthorized retrieval of restricted files such as WEB-INF/web.xml or /etc/passwd. The flaw is classified under CWE-22 (Path Traversal) and is exploitable over the network without authentication or user interaction.
Critical Impact
Unauthenticated attackers can force the server to include arbitrary local or remote Facelet resources, exposing sensitive configuration files and secrets.
Affected Products
- Eclipse Mojarra 2.3.x
- Eclipse Mojarra 3.x
- Eclipse Mojarra 4.x (versions inheriting the affected DefaultFaceletFactory logic)
Discovery Timeline
- 2026-08-05 - CVE-2026-46581 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-46581
Vulnerability Analysis
Eclipse Mojarra is the reference implementation of Jakarta Server Faces (JSF). The DefaultFaceletFactory is responsible for locating and loading Facelet templates referenced by an application. When resolving these references, the factory accepts URL inputs without validating whether the target resides in the application's trusted resource boundary. An attacker can craft a request that instructs the factory to load a Facelet from a remote HTTP endpoint or a local file URI. The server retrieves and parses the resource as part of the normal request lifecycle, running under the privileges of the application server process.
Root Cause
The root cause is insufficient input validation in the URL handling logic of DefaultFaceletFactory. The factory treats attacker-influenced URLs as trusted resource identifiers, allowing file://, http://, and other schemes to resolve outside the intended web root. This is a classic path traversal and remote resource inclusion issue [CWE-22]. Missing scheme allowlisting and missing canonical path checks let attackers reach files such as WEB-INF/web.xml, which typically contains deployment descriptors and secrets, or operating system files like /etc/passwd.
Attack Vector
Exploitation occurs over the network. The attacker sends an HTTP request that causes the JSF runtime to invoke DefaultFaceletFactory with a controlled URL parameter. Because no authentication is required and the attack complexity is low, any exposed Mojarra endpoint that reflects user input into Facelet resolution is at risk. See the Eclipse Vulnerability Report and Eclipse CVE Assignment for reference material.
Detection Methods for CVE-2026-46581
Indicators of Compromise
- Application access logs containing Facelet or view parameters with http://, https://, file://, or ftp:// scheme prefixes.
- Outbound HTTP connections from the application server to unexpected external hosts during request processing.
- Reads of sensitive paths such as WEB-INF/web.xml, /etc/passwd, or other configuration files reflected in server responses.
- Anomalous 200 responses containing XML or Facelet content sourced from outside the deployed web application.
Detection Strategies
- Inspect web server and reverse-proxy logs for view identifiers or Facelet paths that include absolute URLs or traversal sequences such as ../.
- Correlate inbound HTTP requests to the JSF endpoint with outbound network flows initiated by the JVM process.
- Deploy WAF rules that flag Facelet parameters containing URI schemes or double-encoded traversal characters.
Monitoring Recommendations
- Enable verbose logging on the Mojarra FaceletFactory and ResourceHandler classes to record URL resolution attempts.
- Monitor file access on the application server for reads of WEB-INF/, META-INF/, and OS-level configuration files by the servlet container user.
- Alert on egress traffic from application servers that should not initiate outbound HTTP calls.
How to Mitigate CVE-2026-46581
Immediate Actions Required
- Inventory all deployed applications and identify those bundling or depending on Eclipse Mojarra 2.3 or later.
- Restrict outbound network access from application servers to prevent remote Facelet retrieval.
- Apply strict input validation on any request parameter that flows into JSF view resolution.
- Review web application logs for prior exploitation attempts using URL-scheme payloads.
Patch Information
Monitor the Eclipse CVE Assignment Work Item and the Eclipse Vulnerability Report Work Item for the fixed release. Once available, upgrade to the patched Mojarra version and redeploy affected applications. Rebuild container images and refresh any dependency locks that reference the vulnerable artifact.
Workarounds
- Configure the servlet container's SecurityManager or Java module system to deny file and URL access outside the application root.
- Enforce a WAF policy that blocks Facelet or view parameters containing :// or encoded traversal sequences.
- Run the application server under a least-privilege OS account that cannot read sensitive files such as /etc/passwd.
- Disable or remove any application endpoints that expose user-controlled Facelet or view identifiers until a patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
