What is CVE-2026-46581?

CVE-2026-46581 is a high-severity vulnerability in Eclipse Foundation Mojarra, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-08-05.

How severe is CVE-2026-46581?

High severity. CVSS v3 base score is 7.5 out of 10.

RCE in Eclipse Foundation Mojarra

CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as pa…

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Eclipse Foundation Mojarra — versions 2.3

Weakness classification (CWE)

CWE-22 — Path Traversal
CWE-94 — Code Injection
CWE-641 — Improper Restriction of Names for Files and Other Resources

References

emo@eclipse.org
emo@eclipse.org

Frequently asked questions

What is CVE-2026-46581?: CVE-2026-46581 is a high-severity vulnerability in Eclipse Foundation Mojarra, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-08-05.
How severe is CVE-2026-46581?: High severity. CVSS v3 base score is 7.5 out of 10.