# CVE-2026-41883: OmniFaces EL injection in CDNResourceHandler

Source: https://junglewise.ai/threats/cve-2026-41883-omnifaces-el-injection-in-cdnresourcehandler-wildcard-mapping  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-41883 · Severity: high · CVSS 8.1 · Published 2026-05-08

OmniFaces is a utility library used in Java-based web applications to simplify common development tasks. A vulnerability in how the library handles external content delivery networks (CDNs) allows an attacker to execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to sensitive customer data, or service disruptions.

Technologies: [OmniFaces](https://junglewise.ai/threats/technologies/omnifaces). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [OmniFaces](https://junglewise.ai/threats/vendors/omnifaces).

## Quick answers

**Is CVE-2026-41883 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41883 being exploited in the wild.

**How severe is CVE-2026-41883?** High severity, with a CVSS score of 8.1, published 8 May 2026.

**Which products and versions are affected?** org.omnifaces:omnifaces (Maven) ECOSYSTEM:introduced=0,fixed=1.14.2; OmniFaces < 1.14.2, < 2.7.32, < 3.14.16, < 4.7.5, < 5.2.3, < 1.14.2, 2.0-RC1 to < 2.7.32, 3.0-RC1 to < 3.14.16, 4.0-M1 to < 4.7.5, 5.0-M1 to < 5.2.3.

**Is there a fix for CVE-2026-41883?** Yes. org.omnifaces:omnifaces (Maven): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41883 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41883?** Check whether you run org.omnifaces:omnifaces (Maven) or OmniFaces at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.omnifaces:omnifaces (Maven): upgrade to 1.14.2 or later

  ```sh
  # set org.omnifaces:omnifaces to 1.14.2 in your pom.xml or build.gradle
  ```


## Technical details

A server-side Expression Language (EL) injection vulnerability exists in OmniFaces when using the CDNResourceHandler with wildcard CDN mappings (e.g., libraryName:*=https://cdn.example.com/*). The root cause is the improper neutralization of user-supplied resource names in request URLs, which are subsequently evaluated as EL expressions by the server. An unauthenticated remote attacker can exploit this by crafting a URL containing a malicious EL expression. Depending on the EL implementation and available objects, this can result in Remote Code Execution (RCE), information disclosure, or Denial of Service (DoS). The issue is patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3; users can also mitigate the risk by replacing wildcard mappings with explicit resource-to-URL mappings.

## Affected products

- OmniFaces OmniFaces < 1.14.2, < 2.7.32, < 3.14.16, < 4.7.5, < 5.2.3

## Identifiers

- CVE-2026-41883
- GHSA-vp6r-9m58-5xv8

## Timeline

- 2026-04-15: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD

## References

- [https://github.com/omnifaces/omnifaces/security/advisories/GHSA-vp6r-9m58-5xv8](https://github.com/omnifaces/omnifaces/security/advisories/GHSA-vp6r-9m58-5xv8)

## Related threats

- [OmniFaces unauthenticated resource ID forging in CombinedResourceHandler](https://junglewise.ai/threats/cve-2026-102695-omnifaces-is-a-utility-library-for-faces-in-omnifaces-versions)
- [OmniFaces multiple vulnerabilities in resource handling and push channels](https://junglewise.ai/threats/omnifaces-multiple-vulnerabilities-in-resource-handling-and-push-900a5d03)