EUVD-2026-28794CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.
AnalysisAI
Remote code execution in OmniFaces CDNResourceHandler allows unauthenticated attackers to execute arbitrary code on servers via crafted EL injection in resource URLs. The vulnerability affects applications using wildcard CDN mappings (e.g., libraryName:*=https://cdn.example.com/*), where attackers can embed Expression Language expressions in resource request names that get evaluated server-side. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all applications using OmniFaces and verify which versions are deployed (check pom.xml, build.gradle, or dependency management tools for versions 1.x through 5.x). Within 7 days: Apply vendor patches-upgrade to OmniFaces 1.14.2, 2.7.32, 3.14.16, 4.7.5, or 5.2.3 depending on your current branch; test in non-production environment first. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today