CVE-2026-41883

Vulnerability

Overview

CVE-2026-41883 is a server-side Expression Language (EL) injection vulnerability in the OmniFaces library for Java Faces. The flaw resides in the CDNResourceHandler component when configured with a wildcard CDN mapping, such as libraryName:*=https://cdn.example.com/* [1][3]. An attacker can craft a resource request URL containing an EL expression in the resource name, which is then evaluated by the server [3].

Attack

Vector

The vulnerability is exploitable by sending a specially crafted HTTP request to a web application using the affected configuration. No authentication is required, as the request is processed during resource handling [1]. The EL injection occurs because the resource name from the URL is not sanitized before being used in EL evaluation [3].

Impact

Successful exploitation results in server-side EL injection, which can lead to remote code execution (RCE) depending on the EL implementation and available objects in the context [3]. At a minimum, an attacker can achieve information disclosure and denial of service denial [3]. Applications using only explicit (non-wildcard) mappings are not affected [1][3].

Mitigation

Mitigation

Mitigation

The issue has been patched in OmniFaces versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3 [1][1][3]. As a workaround, administrators can replace wildcard CDN mappings with explicit resource-to-URL mappings to prevent injection [3].