https://seclists.org/oss-sec/2026/q3/952: CVE-2026-82387: Apache Roller: Stod cross-site scripting via uploaded media content type
Published Sep 25, 2026
·Updated
Affected Software
1 affected component
Apache Roller=6.1.5
Frequently Asked Questions
1
Which deployments are affected in practice?
Only Apache Roller 6.1.5 installations with media uploads enabled are affected. Media uploads are disabled by default, so deployments that have not enabled this feature are not affected.
2
What access does an attacker need to exploit this issue?
An attacker needs an account with media-upload rights. They can upload active content while supplying a misleading content type, then need a victim to open the uploaded file for the script to execute.
3
Do the built-in upload type restrictions mitigate the issue?
No. Once media uploads are enabled, the shipped type restrictions do not prevent active content from being uploaded and served with the attacker-supplied content type.
4
What should be done if an immediate upgrade is not possible?
Disable media uploads until Apache Roller can be upgraded. The recommended fixed version is Apache Roller 6.1.6 or later.