CVE-2026-86507

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86507

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86507.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86507

Published

2026-09-28T08:27:20Z

Modified

2026-09-30T03:47:27Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Apache Roller: Stored XSS in comment moderation via comment author URL

Details

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comments on at least one weblog and whose moderator subsequently reviews the submitted comment; no non-default server setting is required. Users are recommended to upgrade to Apache Roller 6.1.6 or later.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86507.json"
}

References

Affected packages

Git / github.com/apache/roller

Affected ranges

Type

GIT

Repo

https://github.com/apache/roller

Events

Introduced

395cfa30a7b274f8540424d11404c3e7433243f8

Last Affected

395cfa30a7b274f8540424d11404c3e7433243f8

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "6.1.5"
        },
        {
            "last_affected":  "6.1.5"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

6.*

6.1.5

roller-6.*

roller-6.1.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86507.json"