CVE-2011-4367

Apache MyFaces Vulnerable to Path Traversal

5.0 MediumPublic exploitFix available

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Exploit likelihood

33.7%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2011-4367
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-4367
Updated: 2026-11-02

EUVDEUVD-2022-3967 No score

Record: EUVD-2022-3967
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gjfx-9wx3-j6r7 No score

Apache MyFaces Vulnerable to Path Traversal

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Record: GHSA-gjfx-9wx3-j6r7
Weakness: CWE-22
Updated: 2026-11-02

OSVGHSA-gjfx-9wx3-j6r7 No score

Apache MyFaces Vulnerable to Path Traversal

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Record: GHSA-gjfx-9wx3-j6r7
Weakness: CWE-22
Updated: 2026-11-02

Affected products

apache myfaces

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.myfaces.core:myfaces-impl` Maven	2.0.0 up to 2.0.12	2.0.12
`org.apache.myfaces.core:myfaces-impl` Maven	2.1.0 up to 2.1.6	2.1.6
`org.apache.myfaces.core:myfaces-impl` Maven	2.0.0 up to 2.0.12, plus listed versions 2.0.12.0.102.0.112.0.22.0.3 Show 6 moreShow less 2.0.42.0.52.0.62.0.72.0.82.0.9	2.0.12
`org.apache.myfaces.core:myfaces-impl` Maven	2.1.0 up to 2.1.6, plus listed versions 2.1.12.1.22.1.32.1.42.1.5	2.1.6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache MyFaces - 'ln' Information Disclosure	2012-02-09
PoC in GitHub	shoucheng3/apache__myfaces_CVE-2011-4367_2-0-11	2025-08-16

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4367 is a medium vulnerability (CVSS 5.0) in Apache Myfaces, published June 19, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 33.7%, the 98th percentile. Fixed in org.apache.myfaces.core:myfaces-impl 2.0.12.