Cross-Site Scripting Vulnerability in Apache Roller by Apache

CVE-2026-82381

What is CVE-2026-82381?

A Cross-Site Scripting vulnerability exists in Apache Roller 6.1.5 due to improper neutralization of input during web page generation. This flaw allows authenticated users with authoring rights to craft malicious content that can be stored and executed in the browsers of other authors or administrators. The compromised functionality occurs without any need for special configuration, making it particularly concerning for weblogs with multiple authors or administrators who may not fully trust one another. To mitigate this risk, users are advised to upgrade to Apache Roller version 6.1.6 or later, which enhances security by handling values outside of JavaScript literals.

References