CVE-2026-118414: Apache Roller: Stored cross-site scripting through the weblog description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Rollerto a version that resolves this vulnerability.Fixed in 6.1.7
Event History
Frequently Asked Questions
Which users are exposed to the stored script?
Members of an affected weblog are exposed when they open the weblog's main menu after a weblog administrator has stored malicious script in that weblog's description.
What level of access does an attacker need?
The attacker needs weblog administrator privileges to modify the weblog description. Exploitation also requires a targeted weblog member to open the main menu.
Are all Apache Roller installations affected?
The issue affects Apache Roller versions 6.1.2 through 6.1.6. The provided information does not identify any configuration prerequisite beyond use of the affected weblog description and main-menu functionality.
What is the remediation?
Upgrade Apache Roller to version 6.1.7 or later.