Cross-site Scripting Vulnerability in Apache Roller by Apache

CVE-2026-108338

What is CVE-2026-108338?

An improper neutralization of input during web page generation vulnerability exists in Apache Roller versions 5.0.1 to 6.1.6. This flaw allows authenticated users with Author roles to inject malicious scripts into entry tags via AtomPub submissions. The inadequate filtering of HTML characters in tag names enables these scripts to execute within the browsers of users viewing the affected weblog. This scenario can lead to significant security risks, particularly if weblog authors are not fully trusted. It is advisable for users to upgrade to Apache Roller version 6.1.7 or later, which addresses this issue by appropriately sanitizing tag names.

References