EUVD-2026-80990
GHSA-5fv6-hxpr-6p55
Severity by source
SSRF/LFI in a request-processing JSF framework is remotely reachable (AV:N) with high confidentiality via internal-resource/file disclosure; auth requirement unconfirmed so PR:N assumed, integrity/availability not evidenced.
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Apache MyFaces, the JSF/Jakarta Faces implementation used by many Java web applications, is affected by a combined server-side request forgery and local file inclusion flaw: an attacker who can reach an application's normal HTTP interface can coerce the server into fetching attacker-chosen URLs or reading files that reside on the application host, giving high confidentiality impact with no integrity or availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating no privileges and no user interaction are needed). The specific vulnerable versions, the feature or parameter that reaches the resource-loading path, and whether a non-default configuration or ProjectStage setting is required could not be confirmed, because the only supplied reference - the oss-security advisory at seclists.org/oss-sec/2026/q3/810 - did not render its body in the available data, leaving no CVSS vector, CWE identifier, CPE string, or fix version in the input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected component is Apache MyFaces, a JSF/Jakarta Faces implementation, and the flaw is a combined SSRF/LFI - the advisory title implies attacker-controlled input reaches a resource-loading or include path that MyFaces then fetches (SSRF to internal/external URLs) or reads from disk (local file inclusion). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signal quality here is poor: no CVSS vector, no CWE, no EPSS, no KEV, no POC, and the only reference (oss-security advisory at seclists.org/oss-sec/2026/q3/810) did not render its body in the provided data - only the subject line is legible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch information was provided in the available data, so no exact fix version can be cited; the first action is to retrieve the oss-security advisory at https://seclists.org/oss-sec/2026/q3/810 and identify the affected MyFaces release line and any published fixed version, then upgrade the MyFaces artifact (and any application server or framework bundling it) accordingly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and service that bundles Apache MyFaces (inspect build manifests and deployed artifacts for myfaces-impl / myfaces-core JARs) and flag which of those are reachable from the internet or partner networks; then apply an edge/WAF virtual patch that blocks requests passing URLs, file paths, or resource-location parameters pointing at internal IP ranges, cloud metadata endpoints, file:// schemes, or absolute filesystem paths, and tighten outbound egress from Java application servers so only approved destinations are reachable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today