The vulnerability is a server‑side expression language injection in OmniFaces. An attacker can embed an EL expression in the resource name used by a CDN resource handler when a wildcard mapping is configured. The expression is evaluated by the server, allowing arbitrary code execution. This flaw results in complete compromise of confidentiality, integrity, and availability of the affected application.

The library OmniFaces, regardless of major version, is affected when the installed version is older than 1.14.2, 2.7.32, 3.14.16, 4.7.5, or 5.2.3. The issue surfaces in any application that employs CDNResourceHandler with a wildcard CDN mapping such as libraryName:*=https://cdn.example.com/*.

The CVSS score of 8.1 indicates high severity. Because the flaw processes user-supplied resource names, an attacker can exploit it remotely over the network without prior authentication. No evidence of exploitation is recorded in the CISA KEV catalog, and EPSS information is not available. The likely attack vector is a crafted HTTP request that includes an EL expression in the requested resource name.