{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108338", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-09T20:18:00.271Z", "datePublished": "2026-11-11T12:39:04.163Z", "dateUpdated": "2026-11-11T12:39:04.163Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-11T12:39:04.163Z"}, "title": "Apache Roller: Stored cross-site scripting through AtomPub entry tags", "problemTypes": [{"descriptions": [{"description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "cweId": "CWE-79", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Roller", "versions": [{"status": "affected", "version": "5.0.1", "lessThanOrEqual": "6.1.6", "versionType": "semver"}], "defaultStatus": "unknown"}], "descriptions": [{"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.</p>"}]}], "references": [{"url": "https://github.com/apache/roller/pull/208", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/xh4kv1zpdzwtpy57hgm7hy576lz758or", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "Moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "dacqu4n", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Apache Roller", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "6.1.6", "status": "affected", "version": "5.0.1", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier."}], "id": "CVE-2026-108338", "lastModified": "2026-11-11T13:17:13.453", "metrics": {}, "published": "2026-11-11T13:17:13.453", "references": [{"source": "security@apache.org", "url": "https://github.com/apache/roller/pull/208"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread/xh4kv1zpdzwtpy57hgm7hy576lz758or"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{}