CVE-2026-41883: Omnifaces

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.

Affected products

• Omnifaces Omnifaces: before 1.14.2 (fixed in 1.14.2); from 2.0-RC1, before 2.7.32 (fixed in 2.7.32); from 3.0-RC1, before 3.14.16 (fixed in 3.14.16); from 4.0-M1, before 4.7.5 (fixed in 4.7.5); from 5.0-M1, before 5.2.3 (fixed in 5.2.3)

Published 2026-05-08. Last modified 2026-06-17.