Severity: Moderate
CVSS 3.1: 5.4 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected versions:
- Apache Roller 4.0 through 6.1.6
Description:
Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to
store script that runs in the browsers of the weblog's visitors. Blogroll links
imported from an OPML file were not checked, and the default theme printed them
without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or
later, which accepts only web links on import and escapes them on output.
Credit:
Ivan Iushkevich (Steph) (finder)
References:
https://github.com/apache/roller/pull/221
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-118413
