PT-2026-37154 · Omnifaces · Omnifaces

Clapbr · Published 2026-04-16 · Updated 2026-05-08 · CVE-2026-41883

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OmniFaces versions prior to 1.14.2 OmniFaces versions prior to 2.7.32 OmniFaces versions prior to 3.14.16 OmniFaces versions prior to 4.7.5 OmniFaces versions prior to 5.2.3

Description Server-side Expression Language (EL) injection allows for Remote Code Execution (RCE), information disclosure, or denial of service. This occurs in applications using CDNResourceHandler with a wildcard CDN mapping (e.g., 'libraryName:=https://cdn.example.com/'). An attacker can craft a resource request URL containing an EL expression in the resource name, which is then evaluated on the server. The impact depends on the EL implementation and the objects available in the EL context.

Recommendations Update to version 1.14.2 Update to version 2.7.32 Update to version 3.14.16 Update to version 4.7.5 Update to version 5.2.3 Replace wildcard CDN mappings with explicit resource-to-URL mappings.

Fix

RCE

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2026-41883

GHSA-VP6R-9M58-5XV8

Affected Products

Omnifaces

References · 6

• https://osv.dev/vulnerability/GHSA-vp6r-9m58-5xv8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41883 · Security Note
• https://github.com/omnifaces/omnifaces/security/advisories/GHSA-vp6r-9m58-5xv8 · Note
• https://github.com/omnifaces/omnifaces · Note
• https://t.me/CVEtracker/53131 · Telegram Post
• https://twitter.com/CVEnew/status/2052810973652631930 · Twitter Post