Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-06T12:01:27 wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-94

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.

Red Hat JBoss Enterprise Application Platform 7.4.25 2026-08-11T00:00:00Z RHSA-2026:53806 jsf-impl Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 8 Affected jakarta.faces Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected jsf-impl https://www.cve.org/CVERecord?id=CVE-2026-46581 https://nvd.nist.gov/vuln/detail/CVE-2026-46581