CVE-2026-111824: vulnerability in Apache Roller
Apache Roller: Stored cross-site scripting through custom-theme resource URLs
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form.
Affected products
Apache Software Foundation · Apache RollerRelated CVEs — Apache Roller
In the same product, most dangerous first.
CVE-2018-17198—CVE-2018-17198EPSS 4.1%CVE-2021-33580—regex injection leading to DoSEPSS 3.3%CVE-2023-37581—Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.EPSS 1.2%CVE-2025-24859LOWApache Roller: Insufficient Session Expiration on Password ChangeEPSS 1.2%CVE-2026-82384CRITICALApache Roller: Unauthenticated deserialization in the XML-RPC endpointEPSS 1.0%CVE-2024-25090MEDIUMApache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users modeEPSS 0.8%