Cross-Site Scripting Vulnerability in Apache Roller by Apache

CVE-2026-82387

What is CVE-2026-82387?

Apache Roller version 6.1.5 is susceptible to a Cross-site Scripting vulnerability. This issue arises from improper handling of uploaded media content, where the application trusts the file's supplied content type. If a user with media-upload rights uploads a malicious file, it can be executed as active content when a victim accesses the file. Although media uploads are disabled by default, installations that enable this feature expose themselves to risk if appropriate restrictions are not applied. Users are strongly advised to upgrade to version 6.1.6 or later, which improves type validation by deriving the stored type from file content while treating non-image media as downloads.

References