Apache Roller 6.1.5 permits a user with media-upload rights to store active content by trusting the file’s declared content type and serving the file with that type. A stored script is executed whenever a victim opens the uploaded media file. This stored cross-site scripting can lead to arbitrary client-side code execution, including credential theft or session hijacking, as the script runs in the victim’s browser.

The affected product is Apache Roller from the Apache Software Foundation. Version 6.1.5 is vulnerable when the media-upload feature is enabled. Media uploads are disabled by default, therefore installations that have deliberately enabled uploads and have not upgraded to a fixed release are at risk. No other versions were explicitly listed.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely exploitation path requires an attacker to be granted media-upload rights on the roller instance, upload a crafted script with an allowed MIME type, and convince a victim to open or view the file. Once the vulnerable media-upload feature is enabled, the attack is straightforward and can be performed by a logged-in attacker with upload privileges.