CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type
Apache Roller 6.1.5 allows media uploaders to store XSS by spoofing content type, CVE-2026-82387.
Apache disclosed CVE-2026-82387, a stored cross-site scripting flaw in Apache Roller 6.1.5 with a CVSS 3.1 score of 5.4. A user who already has media-upload rights can store active content on the Roller origin because uploads trust the supplied content type and that content is then served. Exploitation requires low privileges and user interaction, with low confidentiality and integrity impact. No in-the-wild exploitation is reported.
- CVE-2026-82387 scores CVSS 3.1 5.4, moderate
- Attacker needs media-upload privileges on Apache Roller 6.1.5
- Upload feature trusts the client-supplied content type
- Served active content can execute as stored XSS after user interaction
- CVEs
- CVE-2026-82387
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82387 | Stored XSS in Apache Roller via media upload type | 5.4 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Moderate CVSS 3. 1: 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.