This vulnerability is a stored XSS affecting Apache Allura releases up to version 1.20.0 that is triggered by injected script code into SVN repository pages. The injected script is saved in the repository and executed whenever a user views the vulnerable page, allowing an attacker to run arbitrary JavaScript in the victim’s browser. Such client‑side code can read or tamper with page data, hijack user sessions or perform other malicious actions. The weakness is a classic input validation flaw that permits malicious data to be stored and rendered unchecked, described by CWE‑79.

The affected product is Apache Allura, all releases through 1.20.0, delivered by the Apache Software Foundation. Git repositories are not known to be vulnerable. The flaw disappears in 1.21.0, which contains a fix that blocks the injection vector.

EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV catalog; however stored XSS generally carries a high exploitation risk if an attacker can insert code. The default Content‑Security‑Policy headers provide mitigation by limiting inline script execution, but incorrect or missing CSP configuration could still allow exploitation. With a CVSS score of 6.1, the underlying weakness is considered medium‑to‑high severity, highlighting the importance of promptly applying the vendor‑provided fix.