CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
Apache Roller 6.1.5 reflected XSS targets frontpage-theme visitors through a crafted directory parameter.
CVE-2026-82382 is a reflected cross-site scripting flaw in Apache Roller 6.1.5, scored CVSS 3.1 6.1 and rated Moderate. A remote attacker can supply a crafted blog-directory parameter to the bundled frontpage theme and run script in a weblog visitor's browser. The issue requires user interaction and has low confidentiality and integrity impact with changed scope. The post does not report active exploitation.
- CVE-2026-82382 is reflected XSS in Apache Roller 6.1.5.
- A crafted blog-directory parameter targets visitors using the bundled frontpage theme.
- CVSS 3.1 is 6.1 and requires user interaction.
- No in-the-wild exploitation is described.
- CVEs
- CVE-2026-82382
- Vendors
- Apache Software Foundation
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82382 | Reflected XSS in Apache Roller frontpage theme | 6.1 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Moderate CVSS 3. 1: 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.