CVE-2026-108338: Apache Roller: Stored cross-site scripting through AtomPub entry tags
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Rollerto a version that resolves this vulnerability.Fixed in 6.1.7 - Configuration
Keep AtomPub disabled unless it is required; it is disabled by default.
Apache Roller AtomPub = disabled
Event History
Frequently Asked Questions
Who is exposed in a typical deployment?
Deployments using Roller 6.1.4 through 6.1.6 with weblogAdminsUntrusted=true are particularly affected, because this setting is the default and treats weblog authors as untrusted. Exposure also requires a theme or macro that renders entry tags without escaping, including the bundled gaurav, fauxcoly, and frontpage themes and the showEntryTags macro.
What does an attacker need to exploit this issue?
The attacker must be authenticated and have the Author role on a weblog. They must be able to submit an entry tag through AtomPub containing script content; AtomPub is disabled by default.
Who is affected when malicious content is stored?
The stored script executes in the browser of anyone who views the affected weblog. This can therefore affect readers rather than only the author who submitted the tag.
What should be done if malicious tags may already exist?
Upgrade to Apache Roller 6.1.7 or later. The fix removes HTML characters from tag names, including tag names that were stored before the upgrade.