CVE-2026-111824

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111824

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111824.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111824

Published

2026-11-11T12:39:22Z

Modified

2026-11-14T02:30:42Z

Summary

Apache Roller: Stored cross-site scripting through custom-theme resource URLs

Details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111824.json"
}

References

Affected packages

Git / github.com/apache/roller

Affected ranges

Type

GIT

Repo

https://github.com/apache/roller

Events

Introduced

47c5cf0bbfa00fe199bc743a7fb88df8e6b21d32

Last Affected

47c5cf0bbfa00fe199bc743a7fb88df8e6b21d32

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "6.1.6"
                },
                {
                    "last_affected": "6.1.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        }
    ]
}

Affected versions

6.*

6.1.6

roller-6.*

roller-6.1.6

roller-6.1.6-rc4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111824.json"