CVE-2026-82382

MEDIUM 6.1

Apache Roller: Reflected cross-site scripting in the frontpage directory parameter

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. This affects only weblogs that use the bundled frontpage theme, and a victim must follow a crafted link for the script to execute. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates and contextually escapes the reflected parameter.

CWE	CWE-79
Vendor	apache software foundation
Product	apache roller
Published	Sep 28, 2026
Last Updated	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache roller

Be the first to know when new medium vulnerabilities affecting apache software foundation apache roller are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Apache Software Foundation / Apache Roller

6.1.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/roller/pull/169 lists.apache.org: https://lists.apache.org/thread/mt01qhjq701o3v7kddgskn2ryb6l6y2x openwall.com: http://www.openwall.com/lists/oss-security/2026/09/25/15

Credits

meifukun