CVE-2011-4367: Apache Myfaces

Medium severity, CVSS 5.0. EPSS: 33.7% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Affected products

• Apache Myfaces: from 2.0.1, up to and including 2.0.11; from 2.1.0, up to and including 2.1.5

Published 2014-06-19. Last modified 2026-06-16.