XSS Vulnerability in Apache Allura Markdown Handling
CVE-2026-73237

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Allura
Vendor: CVE Published:; 12 August 2026

What is CVE-2026-73237?

An XSS vulnerability exists in the Markdown handling of Apache Allura, which could allow attackers to inject malicious scripts through crafted Markdown content. This affects versions of Apache Allura prior to 1.19.1. To mitigate the risk, it is strongly recommended for users to upgrade to version 1.19.1, where the vulnerability has been addressed.

Affected Version(s)

Apache Allura 1.10.0 < 1.19.1

References

https://allura.apache.org/posts/2026-allura-1.19.1.html

https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozx...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 12, 2026
Vulnerability Reserved
Aug 11, 2026

CVE-2026-73237 Data

JSON