Executive brief
Eclipse GlassFish, an application server used for hosting Java-based web applications, contains a critical vulnerability in its gadget handler component. An attacker can exploit this flaw to execute arbitrary commands on the server by submitting specially crafted XML files. This could lead to a full system compromise, allowing unauthorized access to sensitive data, service disruption, and a foothold for further attacks within the corporate network.
Technical details
A critical Expression Language (EL) injection vulnerability (CWE-917) exists in the GlassFish gadget handler's server-side template rendering mechanism. The vulnerability stems from the improper neutralization of user-supplied values within .xml files before they are processed by the EL evaluator. A remote attacker can inject malicious EL expressions (e.g., #{7*7}) to achieve arbitrary code execution on the underlying host. While the CVSS vector indicates some level of user interaction (UI:R), the flaw allows for full compromise of confidentiality, integrity, and availability. The issue is addressed in GlassFish version 8.0.2 and jsftemplating version 4.2.0.
Affected products
- Eclipse Foundation GlassFish < 8.0.2
- Eclipse Foundation jsftemplating < 4.2.0
- Eclipse Foundation admingui < 8.0.2
Timeline
- 2025-12-15: other: Vulnerability reported by Camilo G.
- 2026-05-05: patched: GlassFish 8.0.2 released with fixes
- 2026-05-19: disclosed: NVD and GitHub Advisory published