{"id":"CVE-2026-103863","kind":"vulnerability","aliases":["CVE-2026-103863"],"related":[],"title":"Apache Sling Engine: included components bypass protections, enabling stored XSS","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","summary":"Apache Sling Engine lets an included component change Content-Type, charset and redirect settings in ways that skip its header and content-type checks. An attacker can therefore store script in a page that runs in other users' browsers despite the protections being enabled.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-sling","cms","java","package","stored-xss"],"not_affected_if":["patched-version"],"how_to_check":"- Check the Apache Sling Engine version in your bundle or pom.xml (for example `org.apache.sling.engine`).","fix":"- Apache Sling Engine: upgrade to `3.0.4` or later.","status":"open","published_at":"2026-11-05T13:17:06+00:00","first_seen_at":"2026-11-05T13:39:08+00:00","triaged_at":"2026-11-05T13:40:10+00:00","updated_at":"2026-11-05T13:40:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T13:40:10Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Sling Engine: upgrade to `3.0.4` or later.","reach":"network","title":"Apache Sling Engine: included components bypass protections, enabling stored XSS","impact":"medium","summary":"Apache Sling Engine lets an included component change Content-Type, charset and redirect settings in ways that skip its header and content-type checks. An attacker can therefore store script in a page that runs in other users' browsers despite the protections being enabled.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-sling","java","cms","stored-xss"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs script in other users' browsers via stored content","analyst_note":"","how_to_check":"- Check the Apache Sling Engine version in your bundle or pom.xml (for example `org.apache.sling.engine`).\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Applications running Apache Sling Engine before 3.0.4 that render content from included components. Sites that do not use Sling or that run a patched version can skip it. The sources do not say which configurations are most exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":4313,"output_tokens":479,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103863':13A,16A '-2026':12A,15A '3.0.4':134C,142C '6.1':115C 'affect':129C 'apach':1A,18B,26B,86C,130C 'apache-sl':17B 'api':113C 'attack':53B 'browser':66B 'bypass':6A 'call':108C 'chang':33B,95C 'charset':37B,92C,112C 'check':51B 'checkcontenttyp':103C 'cms':20B 'compon':5A,32B,99C 'config':120C 'content':35B,49B,90C 'content-typ':34B,48B,89C 'cross':81C 'cross-sit':80C 'cve':11A,14A 'despit':67B,124C 'enabl':8A,71B,121C,125C 'enforc':104C 'engin':3A,28B,88C,132C 'evad':100C 'fix':144C 'generat':79C 'header':46B 'improp':72C 'includ':4A,31B,98C 'input':75C 'issu':128C,146C 'java':21B 'let':29B 'neutral':73C 'overload':117C 'packag':22B 'page':60B,78C 'protect':7A,69B,126C 'protecthead':102C 'recommend':137C 'redirect':39B,94C,116C 'repeat':107C 'run':62B 'script':57B,83C 'servlet':114C 'set':40B 'setcontenttyp':110C 'sethead':106C 'site':82C 'skip':44B 'sling':2A,19B,27B,87C,131C 'stale':119C 'store':9A,24B,56B,122C 'stored-xss':23B 'therefor':55B 'type':36B,50B,91C 'upgrad':139C 'user':65B,135C 'version':141C 'vulner':84C 'way':42B 'web':77C 'xss':10A,25B,123C","nicknames":[],"mitigations":[],"who_affected":"Applications running Apache Sling Engine before 3.0.4 that render content from included components. Sites that do not use Sling or that run a patched version can skip it. The sources do not say which configurations are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachesling","cms","java","package","storedxss","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T13:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103863","severity":null,"published_at":"2026-11-05T13:17:06+00:00","modified_at":"2026-11-05T13:17:06+00:00","first_seen_at":"2026-11-05T13:39:08+00:00","fetched_at":"2026-11-05T13:39:08+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}