CVE-2026-82382

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. This affects only weblogs that use the bundled frontpage theme, and a victim must follow a crafted link for the script to execute. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates and contextually escapes the reflected parameter.

Traduire en français

Produits concernés

• Apache Software Foundation Apache Roller

Scores CVSS

Faiblesses (CWE)

• CWE-79

Références

• https://github.com/apache/roller/pull/169
• https://lists.apache.org/thread/mt01qhjq701o3v7kddgskn2ryb6l6y2x
• http://www.openwall.com/lists/oss-security/2026/09/25/15

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories