Cross-Site Scripting Vulnerability in Apache Roller Web Application

CVE-2026-118414

What is CVE-2026-118414?

A cross-site scripting vulnerability exists in Apache Roller versions 6.1.2 through 6.1.6 due to improper handling of user input during web page generation. This flaw allows weblog administrators to store malicious scripts, which can execute in the browsers of users when they access their main menu. Specifically, the issue arises from an HTML-stripping routine that mistakenly preserves an unclosed tag, leading to unsanitized output of the weblog description. Users are strongly encouraged to upgrade to Apache Roller version 6.1.7 or later to mitigate this security risk.

References