CVE-2026-108338
Apache Roller: Stored cross-site scripting through AtomPub entry tags
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.
| CWE | CWE-79 |
| Vendor | apache software foundation |
| Product | apache roller |
| Published | Nov 11, 2026 |
Get instant alerts for apache software foundation apache roller
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache roller are published — delivered to Slack, Telegram or Discord.