XSS Vulnerability in Apache Allura Affects User Code Display
CVE-2026-73238

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Allura
Vendor
CVE Published:
12 August 2026

What is CVE-2026-73238?

An XSS vulnerability has been identified in the code display feature of Apache Allura, which could allow attackers to inject malicious scripts. This issue affects all versions prior to 1.19.1. Users are strongly advised to upgrade to version 1.19.1 or later to mitigate the risk of exploitation.

Affected Version(s)

Apache Allura 0 < 1.19.1

References

https://allura.apache.org/posts/2026-allura-1.19.1.html
https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wk...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.