Not rated
CVE-2026-68536 Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core
Description
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache MyFaces 4.1 | 4.1.0 → < 4.1.4 | 4.1.4 |
| Apache MyFaces 4.0 | 4.0.0 → < 4.0.4 | 4.0.4 |
| Apache MyFaces 3.0 | 3.0.0 → < 3.0.4 | 3.0.4 |
| Apache MyFaces 2.3 | 2.3-next-M1 → < 2.3.12 | 2.3-next-M9 |
| Apache MyFaces 2.2 | 2.2.0-beta → 2.2.15 | No fix stated |