Apache Sling Engine CVE-2026-103863 bypasses include-protection mitigations
Original title: CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
Content-Type, charset, and redirect changes from included components evade header enforcement in Sling Engine before 3.0.4.
Apache Sling Engine has an improper neutralization vulnerability in web page generation. Mitigations for headers can be bypassed by included components using setHeader, setContentType, and charset APIs.
- Improper neutralization of input during web page generation
- Content-Type, charset, and redirect changes evade protectheaders enforcement
- Affected versions: Apache Sling Engine before 3.0.4
- Fixed in version 3.0.4
Impact: cross-site scripting
- 1.Upgrade to Apache Sling Engine 3.0.4
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103863 | Stored XSS in Apache Sling Engine via bypassed protections | 5.4 | — |
From the original article
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3. 0. 4 Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.