Cross-Site Scripting Vulnerability in Apache Roller Affects Authenticated Users

CVE-2026-111824

What is CVE-2026-111824?

Apache Roller version 6.1.6 is affected by an input validation issue that allows authenticated users with the Author role to inject malicious scripts into web pages. The vulnerability emerges specifically when using custom themes, enabling attackers to execute scripts in the browsers of users who access these pages. Although media uploads are generally restricted, the platform previously allowed files with arbitrary paths to be served directly based on how they were uploaded. This flaw necessitates users to upgrade to version 6.1.7 or later, where the handling of media uploads aligns with security protocols for other media types.

References