What is the CVSS score of EUVD-2026-53328?

EUVD-2026-53328 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Eclipse Mojarra are affected by EUVD-2026-53328?

Eclipse Mojarra versions 2.3-5.0 expose a critical vulnerability allowing unauthenticated remote attackers to steal database credentials and sensitive configuration data directly from production…

How to fix or mitigate EUVD-2026-53328?

Within 24 hours, conduct an asset inventory scan to identify all systems running Eclipse Mojarra 2.3-5.0, prioritize production instances, and deploy Web Application Firewall rules to block path traversal and Facelet resolution requests targeting the template engine. Within 7 days, review security logs for exploitation indicators, disable remote template resolution functionality in application configurations where operationally feasible, and establish vendor contact to track patch release timelines. Within 30 days, plan and execute migration to unaffected Mojarra versions, implement application-level input validation and output encoding for JSF template parameters, and enforce restrictive file system permissions on WEB-INF directories to contain the impact of any successful exploitation.

Eclipse Mojarra EUVD-2026-53328

| CVE-2026-46581 HIGH

Path Traversal (CWE-22)

2026-08-05 eclipse

GHSA-wrxx-w58g-3gqp

Path Traversal Eclipse Mojarra Eclipse Foundation

7.5

CVSS 3.1 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible JSF endpoint with no authentication or configuration prerequisite; only confidentiality impacted through file disclosure, no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:43 vuln.today

CVE Published

Aug 05, 2026 - 11:09 cve.org

HIGH 7.5

CVE Published

Aug 05, 2026 - 11:09 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd.

AnalysisAI

Remote file inclusion and path traversal in Eclipse Mojarra 2.3 through 5.0 allows unauthenticated network attackers to force server-side Facelet resolution of attacker-controlled URLs via the DefaultFaceletFactory component, exposing restricted files with the privileges of the application server. The attack targets the JSF template resolution pipeline and can leak sensitive configuration data from WEB-INF/web.xml (which typically contains database credentials and security settings) or OS-level files such as /etc/passwd. SSVC rates the attack as automatable with no confirmed active exploitation at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector means no barriers exist between a remote attacker and a vulnerable endpoint.

Technical ContextAI

Eclipse Mojarra is the reference implementation of Jakarta Faces (formerly JavaServer Faces/JSF), the standard component-based UI framework for Java EE and Jakarta EE web applications. The vulnerability resides in DefaultFaceletFactory, the subsystem responsible for locating, loading, and compiling Facelet view templates (typically .xhtml files) at request time. In JSF, view identifiers are resolved to resource URLs; the affected code path fails to validate whether a resolved URL references a remote host or traverses outside the web application's intended resource scope. CWE-22 (Path Traversal) captures the root cause: the URL is used to construct a file or network path without neutralizing special sequences, allowing traversal into protected directories such as WEB-INF/ (which Java EE containers protect from direct HTTP access but not from server-side file reads) and arbitrary filesystem paths. The CPE cpe:2.3:a:eclipse_foundation:eclipse_mojarra:*:*:*:*:*:*:*:* confirms this affects the Eclipse Foundation's Mojarra distribution across the 2.3-5.0 version range per EUVD-2026-53328.

RemediationAI

The primary remediation is to upgrade Eclipse Mojarra to the patched release identified in the Eclipse security advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/544; the exact fixed version number is not confirmed from the provided input data and must be verified directly with the Eclipse Foundation before upgrading. As a compensating control, operators should configure web application firewall rules to detect and block view ID parameters containing remote URL schemes (http://, https://, //) or path traversal sequences (../, ..%2F) before they reach JSF processing - note that overly broad WAF rules may interfere with legitimate JSF navigation that passes view IDs as request parameters. Enabling strict egress filtering at the network layer to prevent the application server from making outbound HTTP requests eliminates the remote Facelet inclusion vector, though this does not address the local file traversal path. Hardening file system permissions so the application server process cannot read OS-level files (e.g., /etc/passwd) limits impact from the local traversal scenario. Reviewing whether JSF view IDs are client-controllable in the application and restricting them to a server-side allowlist is the most effective architectural mitigation while awaiting a patch.