This vulnerability is a stored XSS affecting Apache Allura releases up to version 1.20.0 that is triggered by injected script code into SVN repository pages. The injected script is saved in the repository and executed whenever a user views the vulnerable page, allowing an attacker to run arbitrary JavaScript in the victim’s browser. Such client‑side code can read or tamper with page data, hijack user sessions or perform other malicious actions. The weakness is a classic input validation flaw that permits malicious data to be stored and rendered unchecked, described by CWE‑79.

The affected product is Apache Allura, all releases through 1.20.0, delivered by the Apache Software Foundation. Git repositories are not known to be vulnerable. The flaw disappears in 1.21.0, which contains a fix that blocks the injection vector.

No EPSS score is available and the flaw is not listed in the CISA KEV catalog, yet stored XSS generally carries a high exploitation risk if an attacker can insert code. The default Content‑Security‑Policy headers provide mitigation by limiting inline script execution, but incorrect or missing CSP configuration could still allow exploitation. Although a CVSS score is not provided, the nature of the flaw indicates a significant threat if an attacker gains write access to the repository.