Cross-Site Scripting Vulnerability in Apache Roller by Apache

CVE-2026-82382

What is CVE-2026-82382?

A Cross-Site Scripting (XSS) vulnerability exists in Apache Roller 6.1.5, enabling a remote attacker to exploit the weblog's frontpage theme. The vulnerability arises from improper neutralization of user input, specifically a crafted 'blog-directory' parameter. When this parameter is reflected on the webpage without adequate escaping, it allows attackers to inject malicious scripts. This risk is significant because users must click on a specially crafted link for the exploit to trigger. To mitigate this issue, users are strongly advised to upgrade to Apache Roller version 6.1.6 or later, which includes necessary validations and escaping for reflected parameters.

References