CVE-2026-68536

Apache MyFaces Core's Facelets view handling resolves the path of an included or referenced Facelet resource -- for example a <ui:include> or <ui:decorate> whose src is bound to an EL expression, or a composite-component library path -- without checking the resulting URL's scheme or verifying that it stays within the application's own resource base. DefaultFaceletFactory.resolveURL() passed the raw path straight into java.net.URL(URL,String), so a path influenced by request data could redirect resolution to an external http(s) address, producing server-side request forgery, or to a local file/jar URL outside the application, producing local file inclusion. An application (or the framework itself, through any caller of getFacelet()) that resolves a Facelet path built from request-controlled data can be made to issue outbound requests to an attacker-chosen destination or to read local files reachable via file/jar URLs.