PT-2026-46841 · Maven · Org.Glassfish.Jsftemplating:Jsftemplating+1

Published 2026-05-19 · Updated 2026-05-19

OSV

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.

Fix

Weakness Enumeration

CWE-917

Related Identifiers

GHSA-29WV-CV7P-XJC2

Affected Products

Org.Glassfish.Jsftemplating:Jsftemplating

Org.Glassfish.Main.Admingui:Admingui

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2587 · Security Note
• https://osv.dev/vulnerability/GHSA-29wv-cv7p-xjc2 · Vendor Advisory
• https://github.com/eclipse-ee4j/glassfish · Note
• https://github.com/eclipse-ee4j/glassfish/releases/tag/8.0.2 · Note
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/86 · Note