Apache Sling Engine CVE-2026-103863 bypasses include-protection mitigations
Content-Type, charset, and redirect changes from included components evade header enforcement in Sling Engine before 3.0.4.
30
CVE-2026-103863
Stored XSS in Apache Sling Engine via bypassed protections
- CVSS 3.1
- 5.4 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Sling Engine has a stored XSS flaw from improper input neutralization. Bypasses to protectheaders/checkcontenttype happen via setHeader(), repeated setContentType() calls, charset APIs, Servlet redirect overloads, and stale config. This enables stored XSS even when protections are enabled. An attacker triggers it with malicious included components. Affects Apache Sling Engine users before 3.0.4.
What to do: Upgrade to Apache Sling Engine 3.0.4. No workaround mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Sling Engine | before 3.0.4 | 3.0.4 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Weakness
- CWE-79, CWE-693
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N