{"id":"CVE-2026-102695","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102695","generatedAt":"2026-10-28T03:39:36.926Z","title":"Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources.","description":"OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.","published":"2026-10-14T16:17:30.000Z","lastModified":"2026-10-20T02:17:08.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},"cwe":["CWE-345","CWE-409","CWE-552"],"affected":[],"epss":{"score":0.00306,"percentile":0.23216,"date":"2026-10-27","history":[{"date":"2026-10-15","score":0.00306,"percentile":0.21786}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T16:17:30.000Z","detail":{"score":"8.2","severity":"HIGH","publishedAt":"2026-10-14T16:17:29.840Z"},"summary":"New CVE, high severity (CVSS 8.2)."}],"references":[{"url":"https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786","source":"security-advisories@github.com"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/1.14.3","source":"security-advisories@github.com"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/2.7.33","source":"security-advisories@github.com"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/3.14.23","source":"security-advisories@github.com"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/4.7.12","source":"security-advisories@github.com"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/5.4.2","source":"security-advisories@github.com"},{"url":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102695","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}