CVE-2026-82381

Apache Roller 6.1.5 has a stored cross-site scripting flaw in the authoring UI. A user who already has authoring rights on a weblog can save crafted content that is later written into JavaScript string literals and markup sinks without proper encoding. When another author or an administrator opens the authoring UI, that stored script runs in their browser, with the potential to act in their session. No optional feature or non-default configuration is required; multi-author or multi-administrator weblogs whose users are not mutually trusted are affected. There is no known public proof of concept and no report of exploitation in the wild; the fix is Apache Roller 6.1.6 or later.

What to do: Upgrade Apache Roller to 6.1.6 or later, which moves the affected values out of JavaScript literals and writes them as text. Until then, limit weblog authoring rights to mutually trusted users and review recently stored authoring content for unexpected script or markup.