Severity: moderate Affected versions:
- Apache MyFaces (org.apache.myfaces.core:myfaces-impl) 2.2.* - Apache MyFaces (org.apache.myfaces.core:myfaces-impl) 2.3.* - Apache MyFaces (org.apache.myfaces.core:myfaces-impl) 3.0.* - Apache MyFaces (org.apache.myfaces.core:myfaces-impl) 4.0.* - Apache MyFaces (org.apache.myfaces.core:myfaces-impl) 4.1.* - Apache MyFaces (org.apache.myfaces.core:myfaces-impl) 2.3-next-* Description: Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue. References: https://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq https://myfaces.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-68536
