SSRF in Apache Software Foundation Myfaces
CVE-2026-68536
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Vulnerability class: SSRF (Server-Side Request Forgery)
Affected products
- Apache Software Foundation Myfaces — versions 2.3.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108