CVE-2026-118413
Apache Roller: Stored cross-site scripting through imported blogroll links
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.
| CWE | CWE-79 |
| Vendor | apache software foundation |
| Product | apache roller |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache roller
Be the first to know when new medium vulnerabilities affecting apache software foundation apache roller are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Apache Software Foundation / Apache Roller
4.0 ≤ 6.1.6
References
Credits
Ivan Iushkevich (Steph)