org.apache.myfaces.core/myfaces-impl vulnerabilities

Latest org.apache.myfaces.core/myfaces-impl CVEs

Newest publication first

1. CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

   Published 2026-09-16

   Critical·CVSS 9.8 EPSS 0.49%

   Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

2. CVE-2011-4367 Apache MyFaces Vulnerable to Path Traversal

   Published 2014-06-19

   Medium·CVSS 5.0 EPSS 33.7%

   Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2)...

3. CVE-2010-2057 Improper Authentication in Apache MyFaces

   Published 2010-10-20

   Medium·CVSS 5.0 EPSS 3.0%

   shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.