PT-2026-46854 · Maven · Org.Glassfish.Jsftemplating:Jsftemplating+1

Publicado 2026-05-19 · Atualizado 2026-05-19

OSV

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

GHSA-96V6-HQ43-X9H4

Produtos afetados

Org.Glassfish.Jsftemplating:Jsftemplating

Org.Glassfish.Main.Admingui:Console-Common

Referências · 5

• https://github.com/eclipse-ee4j/glassfish · Nota
• https://github.com/eclipse-ee4j/glassfish/releases/tag/8.0.2 · Nota
• https://osv.dev/vulnerability/GHSA-96v6-hq43-x9h4 · Aviso do Fabricante
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/87 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2586 · Nota de Segurança