Executive brief
Apache MyFaces Core is a Java web framework used to build dynamic web applications. This vulnerability allows attackers to make arbitrary HTTP requests on behalf of the server and read local files, potentially exposing sensitive data and enabling further attacks on internal systems and networks.
Technical details
This vulnerability is a server-side request forgery (SSRF) and local file inclusion (LFI) flaw in Apache MyFaces Core that allows remote attackers to make unauthorized requests and access local files. The vulnerability is network-reachable and does not require authentication. An attacker can leverage this to access internal services, retrieve sensitive configuration files, or interact with backend systems. Apache has released patched versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, and 4.1.4 to address this issue. Older unsupported versions also require patching.
Affected products
- Apache MyFaces Core versions prior to 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4
Timeline
- 2026-09-16: disclosed