---
id: "CVE-2026-103864"
kind: "vulnerability"
aliases: ["CVE-2026-103864"]
title: "Apache Sling Engine: unescaped log output can forge or hide log entries"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-sling", "java", "runtime", "self-hosted"]
not_affected_if: ["sling-engine-3.0.4-or-later"]
published_at: "2026-11-05T13:17:07+00:00"
first_seen_at: "2026-11-05T13:39:09+00:00"
updated_at: "2026-11-05T13:40:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103864", "first_seen_at": "2026-11-05T13:39:09+00:00"}]
exploit_sources: []
---

# Apache Sling Engine: unescaped log output can forge or hide log entries

Apache Sling Engine does not neutralize special characters in data written to its logs before version 3.0.4. An attacker who controls logged input can inject fake lines or hide real entries from the log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache Sling Engine version in the project's dependency file, for example `org.apache.sling:org.apache.sling.engine` in a Maven pom.xml.
- Confirm whether the version is below `3.0.4`.

## Fix

- Apache Sling Engine: upgrade to `3.0.4` or later.

## Timeline

- 2026-11-05T13:39:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103864

## From the sources

Improper output neutralization for logs in Apache Sling Engine.



This issue affects Apache Sling Engine: before 3.0.4.



Users are recommended to upgrade to version 3.0.4, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_