Description
The JBoss Seam Framework is an application framework for building web applications in Java. An input sanitization flaw was found in the way JBoss Seam processed certain parametrized JBoss Expression Language (EL) expressions. A remote attacker could use this flaw to execute arbitrary code via a URL, containing appended, specially-crafted expression language parameters, provided to certain applications based on the JBoss Seam framework.
Remediation
Apply the jboss-seam2 security update or upgrade to the latest version of JBoss Seam framework.
References
Related Vulnerabilities
PHP curl_exec() url is controlled by user
Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)
WordPress Plugin WP-Syntax Remote PHP Code Execution (0.9.9)
Sitecore XM/XP Insecure Deserialization (CVE-2025-27218)
WordPress Plugin All-in-One WP Migration Remote Code Execution (2.0.2)