Severity: Moderate
Affected versions:
- Apache Roller 5.0.1 through 6.1.6
Description:
Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user
with the Author role on a weblog to store script in entry tags submitted
through AtomPub. Roller's tag filter allowed HTML characters in tag names, and
the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro
print tag names without escaping, so the script runs in the browser of anyone
who views the weblog. This matters when weblog authors are not trusted with
script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is
disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or
later, which removes HTML characters from tag names, including names stored
earlier.
Credit:
dacqu4n (finder)
References:
https://github.com/apache/roller/pull/208
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-108338
