Cross-site Scripting Vulnerability in Apache Roller by Apache
CVE-2026-118413

5.4MEDIUM

Key Information:

Vendor

Apache
Status
Apache Roller
Vendor
CVE Published:
11 November 2026

What is CVE-2026-118413?

A Cross-site Scripting (XSS) vulnerability in Apache Roller versions 4.0 through 6.1.6 allows weblog administrators to unintentionally store and serve malicious scripts to visitors. This issue arises because imported Blogroll links from OPML files are not properly validated and are rendered without escaping in the default theme. Malicious users could exploit this vulnerability to execute arbitrary scripts in the browsers of unsuspecting visitors. To mitigate this risk, users should upgrade to Apache Roller version 6.1.7 or a later version, which correctly handles link imports and ensures proper output escaping.

Affected Version(s)

Apache Roller 4.0 <= 6.1.6

References

https://github.com/apache/roller/pull/221
patch
https://lists.apache.org/thread/y6cqvqh5sp31kr47347gmv93m...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Iushkevich (Steph)
.