XSS Vulnerability in Apache Allura Markdown Handling
CVE-2026-73237

6.1MEDIUM

Key Information:

Vendor

Apache
Status
Apache Allura
Vendor
CVE Published:
12 August 2026

What is CVE-2026-73237?

An XSS vulnerability exists in the Markdown handling of Apache Allura, which could allow attackers to inject malicious scripts through crafted Markdown content. This affects versions of Apache Allura prior to 1.19.1. To mitigate the risk, it is strongly recommended for users to upgrade to version 1.19.1, where the vulnerability has been addressed.

Affected Version(s)

Apache Allura 1.10.0 < 1.19.1

References

https://allura.apache.org/posts/2026-allura-1.19.1.html
https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozx...
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.