Skip to content
NewA calmer, faster ZeroHour
Vulnerability2

CVE-2026-91204

Stored XSS via javascript: URI in Apache Roller comments

CVSS 3.1
6.1 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-91204 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Apache Roller 6.1.5 has a stored cross-site scripting flaw in HTML comment handling. An anonymous remote attacker can post a comment that contains a javascript: URI link; that link survives HTMLSubset comment formatting and runs script in the browser of a visitor who clicks it. Impact is limited to confidentiality and integrity in the visitor’s browser (CVSS 3.1 base score 6.1) and requires user interaction. Only sites with users.comments.htmlenabled=true and the HTMLSubset formatter are affected; moderation, if enabled, merely delays publication. There is no known public proof of concept and the issue is not listed in CISA KEV.

What to do: Upgrade Apache Roller to 6.1.6 or later, which limits restored comment links to http, https, and mailto. Until then, set users.comments.htmlenabled=false or stop using the HTMLSubset comment formatter, and review existing HTML comments for javascript: links. Comment moderation only delays publication; it does not remove the flaw.

ProductAffected
Apache Software Foundation Apache Roller6.1.5
Estimated exposure
nicheNo basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it. This affects only sites that enable HTML in comments (users.comments.htmlenabled=true) together with the HTMLSubset comment formatter; comment moderation, where enabled, delays publication. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts restored links to http, https and mailto URIs.

Weakness
CWE-79
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story