CVE-2026-118413: Apache Roller: Stored cross-site scripting through imported blogroll links
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Rollerto a version that resolves this vulnerability.Fixed in 6.1.7
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected script?
A weblog administrator who can import a crafted OPML blogroll can store the script. Visitors to the affected weblog are exposed when the default theme renders the imported blogroll links.
Are default installations affected?
The default theme is affected because it printed imported blogroll links without escaping them. Exploitation also requires use of the OPML blogroll import path and a weblog administrator able to perform the import.
What versions should be remediated?
Apache Roller 4.0 through 6.1.6 are affected. Upgrade to Apache Roller 6.1.7 or later, which restricts imported links to web links and escapes them when rendering output.
How can I identify potentially affected content?
Review blogroll links that were imported from OPML files on affected versions, particularly for link values that are not normal web links or contain script-like content. The issue is relevant where those blogrolls are displayed by the default theme.