Threats affecting pkg:maven/org.eclipse/mojarra

CVE-2026-46581 is a high severity path traversal vulnerability in Eclipse Mojarra version 2.3. The issue arises from improper URL handling in the DefaultFaceletFactory component, which fails to sanitize or block remote URLs. This flaw allows an attacker to specify a remote Facelet URL that the server includes and processes with its privileges, potentially exposing restricted files such as WEB-INF/web.xml or /etc/passwd.