CVE-2026-41883 OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
Attacker can achieve remote code execution via EL injection in resource names when using wildcard CDN mapping in OmniFaces.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41883?
CVE-2026-41883 is a high-severity code injection vulnerability in omnifaces, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.
Weakness: CWE-917
Which versions are affected by CVE-2026-41883?
10 open source packages ship an affected version, including org.omnifaces:omnifaces.
| Package | Affected | Fixed in |
|---|---|---|
org.omnifaces:omnifaces Maven | All versions | 1.14.2 |
org.omnifaces:omnifaces Maven | All versions | 1.14.2 |
org.omnifaces:omnifaces Maven | From 2.0-RC1 | 2.7.32 |
org.omnifaces:omnifaces Maven | From 2.0-RC1 | 2.7.32 |
org.omnifaces:omnifaces Maven | From 3.0-RC1 | 3.14.16 |
org.omnifaces:omnifaces Maven | From 3.0-RC1 | 3.14.16 |
4 more packages
org.omnifaces:omnifaces Maven | From 4.0-M1 | 4.7.5 |
org.omnifaces:omnifaces Maven | From 4.0-M1 | 4.7.5 |
org.omnifaces:omnifaces Maven | From 5.0-M1 | 5.2.3 |
org.omnifaces:omnifaces Maven | From 5.0-M1 | 5.2.3 |
How do I fix CVE-2026-41883?
Upgrade org.omnifaces:omnifaces to a fixed version for your release line: 1.14.2, 2.7.32, 3.14.16 or 4.7.5.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41883 being exploited?
There is no known exploitation of CVE-2026-41883 in the wild and no public exploit code.
Sources
Also known as GHSA-vp6r-9m58-5xv8.