CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

Published Nov 5, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.

This issue affects Apache Sling Engine before 3.0.4.

Users are recommended to upgrade to version 3.0.4, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Sling Engine to a version that resolves this vulnerability.
Fixed in 3.0.4

Event History

Nov 5, 2026

CVE Published

via MITRE·12:31 PM

Data Sourced

via MITRE·12:31 PM

DescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Apache Sling Engine versions before 3.0.4 are affected. The bypass applies where include-protection enforcement such as protectheaders or checkcontenttype is enabled.

What does an attacker need to exploit this issue?

The issue involves an included component changing response Content-Type, charset, or redirect behavior through response-wrapper paths not fully covered by the protections. The available information identifies stored XSS as the resulting impact but does not specify the prerequisite permissions or input path needed to control such a component.

Are enabled include-protection settings sufficient mitigation?

No. The vulnerability specifically allows Content-Type, charset, and redirect changes to evade protectheaders and checkcontenttype enforcement, including through setHeader(), repeated setContentType() calls, charset APIs, Servlet 6.1 redirect overloads, and stale configuration behavior.

What should teams do to remediate the issue?

Upgrade Apache Sling Engine to version 3.0.4. This version fixes the bypass paths described in the advisory.

CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Are enabled include-protection settings sufficient mitigation?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Are enabled include-protection settings sufficient mitigation?

What should teams do to remediate the issue?