Cross-Site Scripting Vulnerability in Apache Sling Engine
CVE-2026-103863

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Sling Engine
Vendor
CVE Published:
5 November 2026

What is CVE-2026-103863?

A vulnerability exists in the Apache Sling Engine that allows improper neutralization of input during web page generation, leading to potential stored cross-site scripting (XSS) attacks. This issue arises from the handling of Content-Type, charset, and redirect changes coming from included components, which can bypass the protective measures of checkcontenttype and protectheaders due to setHeader() calls, repeated invocations of setContentType(), and Servlet 6.1 redirect overloads. As a result, despite the presence of safeguarding mechanisms, users may be at risk of stored XSS if utilizing versions prior to 3.0.4. Upgrading to version 3.0.4 is crucial to remediate this vulnerability.

Affected Version(s)

Apache Sling Engine 0 < 3.0.4

References

https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Apache Software Foundation
Claude Code
.