CVE-2026-108338

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108338

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108338.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108338

Published

2026-11-11T12:39:04Z

Modified

2026-11-14T02:31:07Z

Summary

Apache Roller: Stored cross-site scripting through AtomPub entry tags

Details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108338.json"
}

References

Affected packages

Git / github.com/apache/roller

Affected ranges

Type

GIT

Repo

https://github.com/apache/roller

Events

Introduced

7ac1ef5e263e9ddb520b258a72b0c23d43974c88

Last Affected

47c5cf0bbfa00fe199bc743a7fb88df8e6b21d32

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.0.1"
                },
                {
                    "last_affected": "6.1.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "5.0.1"
                },
                {
                    "last_affected": "6.1.6"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108338.json"