CVE-2026-82387

Apache Roller 6.1.5 has a stored cross-site scripting flaw in its media upload feature. A user who already has media-upload rights can upload a file whose declared content type is trusted and then served back from the Roller origin, so a victim who opens that file runs the stored script in the site's origin. Impact is limited to confidentiality and integrity in the victim's browser session (CVSS 3.1 base score 5.4) and requires both an authenticated uploader and a user who opens the file. Only installations that turn media uploads on are affected; uploads are off by default, and the shipped type restrictions do not stop active content once uploads are enabled. There is no known public proof of concept and the issue is not listed in CISA KEV.

What to do: Upgrade Apache Roller to 6.1.6 or later, which sets the stored content type from file content and serves non-image media as a download. Until then, leave media uploads disabled (the default) or turn them off, and review existing uploads for files stored and served with active content types such as HTML or script.