Apache Software FoundationCVE-2026-86507
Apache Roller: cross-site scripting
Medium6.1CVE-2026-86507 · Published Sep 28, 2026
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comments on at least one weblog and whose moderator subsequently reviews the submitted comment; no non-default server setting is required. Users are recommended to upgrade to Apache Roller 6.1.6 or later.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Apache Roller Product | <= 6.1.5 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79
More Apache Software Foundation advisories
All Apache Software Foundation| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 28 | Apache Karaf: command injection | High8.8 | 4.4.12 |
| Sep 28 | LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and... | High7.3 | 4.4.12 |
| Sep 28 | Apache Roller: cross-site scripting | Medium6.1 | No fix yet |
| Sep 28 | Apache Roller: cross-site scripting | Medium6.1 | No fix yet |
| Sep 28 | Apache Roller: missing authentication | High8.2 | No fix yet |
| Sep 28 | Apache Roller: unsafe deserialization | Critical9.8 | No fix yet |