CVE-2026-108338: fallo en Apache Roller
Apache Roller: Stored cross-site scripting through AtomPub entry tags
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
0Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Track
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.
Productos afectados
Apache Software Foundation · Apache RollerCVEs relacionadas — Apache Roller
En el mismo producto, de las más peligrosas a las menos.
CVE-2018-17198—CVE-2018-17198EPSS 4.1%CVE-2021-33580—regex injection leading to DoSEPSS 3.3%CVE-2023-37581—Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.EPSS 1.2%CVE-2025-24859LOWApache Roller: Insufficient Session Expiration on Password ChangeEPSS 1.2%CVE-2026-82384CRITICALApache Roller: Unauthenticated deserialization in the XML-RPC endpointEPSS 1.0%CVE-2024-25090MEDIUMApache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users modeEPSS 0.8%