The vulnerability allows a remote attacker to store a comment containing a javascript: URI that survives HTML comment formatting, enabling persistent stored cross‑site scripting if a visitor clicks the link. The weakness, identified as Input Validation flaw, results in arbitrary script execution in the context of the victim’s browser, compromising confidentiality, integrity, and availability of the user session. The attack requires the ability to post a comment on an Apache Rollers site that permits HTML in comments.

Apache Roller version 6.1.5 and potentially earlier releases are affected. The flaw manifests only on sites where the configuration users.comments.htmlenabled=true and the HTMLSubset comment formatter are in use. Sites that have comment moderation enabled may delay the appearance of the malicious comment but are not immune.

The CVSS score of 6.1 reflects a moderate risk with moderate impact and requires network scope. Because the vulnerability is exploitable by anonymous remote users, the risk is higher in publicly accessible deployments. No public exploitation evidence is listed in CISA KEV, and the EPSS score is unknown. Attackers would typically craft a malicious comment containing a javascript: link, rely on users clicking it to trigger the execution. The lack of input sanitization and insufficient comment moderation configuration means the flaw is relatively easy to exploit once the conditions are met.