{"id":"CVE-2026-103864","kind":"vulnerability","aliases":["CVE-2026-103864"],"related":[],"title":"Apache Sling Engine: unescaped log output can forge or hide log entries","description":"Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","summary":"Apache Sling Engine does not neutralize special characters in data written to its logs before version 3.0.4. An attacker who controls logged input can inject fake lines or hide real entries from the log.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-sling","java","runtime","self-hosted"],"not_affected_if":["sling-engine-3.0.4-or-later"],"how_to_check":"- Check the Apache Sling Engine version in the project's dependency file, for example `org.apache.sling:org.apache.sling.engine` in a Maven pom.xml.\n- Confirm whether the version is below `3.0.4`.","fix":"- Apache Sling Engine: upgrade to `3.0.4` or later.","status":"open","published_at":"2026-11-05T13:17:07+00:00","first_seen_at":"2026-11-05T13:39:09+00:00","triaged_at":"2026-11-05T13:40:09+00:00","updated_at":"2026-11-05T13:40:09+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T13:40:09Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Sling Engine: upgrade to `3.0.4` or later.","reach":"unknown","title":"Apache Sling Engine: unescaped log output can forge or hide log entries","impact":"low","summary":"Apache Sling Engine does not neutralize special characters in data written to its logs before version 3.0.4. An attacker who controls logged input can inject fake lines or hide real entries from the log.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-sling","java","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"log entries forged or hidden, weakening audit trails","analyst_note":"","how_to_check":"- Check the Apache Sling Engine version in the project's dependency file, for example `org.apache.sling:org.apache.sling.engine` in a Maven pom.xml.\n- Confirm whether the version is below `3.0.4`.","plain_action":"","needs_analyst":false,"not_affected_if":["sling-engine-3.0.4-or-later"],"who_is_affected":"Teams running Apache Sling-based applications that use Sling Engine below 3.0.4 and log request data they do not control. The sources do not describe a specific trigger path, so whether a given deployment is reachable is unknown. Teams not running Apache Sling can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000672,"input_tokens":4176,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103864':15A,18A '-2026':14A,17A '3.0.4':43B,77C,85C 'affect':72C 'apach':1A,20B,27B,67C,73C 'apache-sl':19B 'attack':45B 'charact':34B 'control':47B 'cve':13A,16A 'data':36B 'engin':3A,29B,69C,75C 'entri':12A,57B 'fake':52B 'fix':87C 'forg':8A 'hide':10A,55B 'host':26B 'improp':61C 'inject':51B 'input':49B 'issu':71C,89C 'java':22B 'line':53B 'log':5A,11A,40B,48B,60B,65C 'neutral':32B,63C 'output':6A,62C 'real':56B 'recommend':80C 'runtim':23B 'self':25B 'self-host':24B 'sling':2A,21B,28B,68C,74C 'special':33B 'unescap':4A 'upgrad':82C 'user':78C 'version':42B,84C 'written':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Sling-based applications that use Sling Engine below 3.0.4 and log request data they do not control. The sources do not describe a specific trigger path, so whether a given deployment is reachable is unknown. Teams not running Apache Sling can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachesling","java","low","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T13:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103864","severity":null,"published_at":"2026-11-05T13:17:07+00:00","modified_at":"2026-11-05T13:17:07+00:00","first_seen_at":"2026-11-05T13:39:09+00:00","fetched_at":"2026-11-05T13:39:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}