Vulnerabilitymedium
CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments
AI summary · grok-4.7Summaries by Vani AI
Apache Roller 6.1.5 lets anonymous users store a javascript: URI that executes for comment visitors.
CVE-2026-91204 is a stored cross-site scripting issue in Apache Roller 6.1.5. An anonymous remote attacker can post a comment containing a javascript: URI that survives HTML comment formatting and can execute script in a visitor's browser. Apache scores it CVSS 3.1 6.1 (medium), with network access, no privileges, and required user interaction. The advisory does not report active exploitation.
Key facts
- Anonymous attackers can store a javascript: URI in a comment.
- The link survives HTML comment formatting and can run in a visitor's browser.
- Affects Apache Roller 6.1.5; CVSS 3.1 score 6.1.
- Rated moderate; user interaction is required.
- CVEs
- CVE-2026-91204
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91204 | Stored XSS via javascript: URI in Apache Roller comments | 6.1 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Moderate CVSS 3. 1: 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.