CVE-2026-91204

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it. This affects only sites that enable HTML in comments (users.comments.htmlenabled=true) together with the HTMLSubset comment formatter; comment moderation, where enabled, delays publication. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts restored links to http, https and mailto URIs.

Traduire en français

Produits concernés

• Apache Software Foundation Apache Roller

Scores CVSS

Faiblesses (CWE)

• CWE-79

Références

• https://github.com/apache/roller/pull/190
• https://lists.apache.org/thread/4qzp8m0438056l5t6m6719ob79gx72lz
• http://www.openwall.com/lists/oss-security/2026/09/25/23

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories