Eclipse Mojarra versions 2.3 and newer permit an attacker to provide a remote URL to a Facelet through DefaultFaceletFactory. The factory does not sanitize or block remote URLs, so the server downloads and processes the Facelet with its own privileges. This can expose restricted files such as WEB‑INF/web.xml or /etc/passwd. The flaw is reflected by CWEs‑22, ‑641, and ‑94.

The vulnerability affects all installations of Eclipse Foundation Eclipse Mojarra starting with version 2.3, including all subsequent minor releases where the DefaultFaceletFactory behavior remained unchanged.

The flaw allows an attacker to fetch and process a remote Facelet, potentially exposing confidential server files such as WEB‑INF/web.xml or /etc/passwd. If an application exposes the factory to user‑supplied URLs, an attacker can trigger the flaw by constructing a request that includes a malicious URL. The CVSS score is 7.5, indicating a high severity, and the EPSS score is not available. The issue is not listed in the CISA KEV catalog, so the exact exploitation likelihood remains unknown, but the potential for significant information disclosure is clear.