CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
Apache Roller 6.1.5 reflected XSS targets frontpage-theme visitors through a crafted directory parameter.
34
Vulnerability2 · 1 read
CVE-2026-82382
Reflected XSS in Apache Roller frontpage theme
- CVSS 3.1
- 6.1 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Roller 6.1.5 has a reflected cross-site scripting flaw (CWE-79) in the bundled frontpage theme. A remote attacker can supply a crafted blog-directory parameter that the directory page echoes without proper escaping, so script runs in a visitor’s browser only if that visitor follows the malicious link. Impact is limited to confidentiality and integrity in the victim’s browser session (CVSS 3.1 base score 6.1); the attacker does not gain direct server compromise, and weblogs that do not use the bundled frontpage theme are not affected. Apache recommends upgrading to Roller 6.1.6 or later. The issue is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade Apache Roller to 6.1.6 or later, which validates and contextually escapes the blog-directory parameter. Until then, avoid the bundled frontpage theme or treat directory links as untrusted, and do not follow unexpected blog-directory URLs.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Roller | 6.1.5 when the bundled frontpage theme is in use |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. This affects only weblogs that use the bundled frontpage theme, and a victim must follow a crafted link for the script to execute. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates and contextually escapes the reflected parameter.
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N