{"id":"CVE-2026-108338","kind":"vulnerability","aliases":["CVE-2026-108338"],"related":[],"title":"Apache Roller: stored script in entry tags via AtomPub","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.","summary":"Apache Roller 5.0.1 through 6.1.6 lets an authenticated Author store script in weblog entry tags submitted through AtomPub. The script runs in the browser of anyone who views the weblog.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Roller","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-roller","atompub","java","package","self-hosted"],"not_affected_if":["atompub-disabled","default-config","trusted-authors"],"how_to_check":"- Check the Roller version in use; affected range is `5.0.1` through `6.1.6`.\n- Check whether AtomPub is enabled; it is disabled by default.\n- Check whether `weblogAdminsUntrusted` is set to `true` (default since `6.1.4`).","fix":"- Apache Roller: upgrade to `6.1.7` or later, which removes HTML characters from tag names, including names stored earlier.","status":"open","published_at":"2026-11-11T13:17:13+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:30:07+00:00","updated_at":"2026-11-11T13:30:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:30:07Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller: upgrade to `6.1.7` or later, which removes HTML characters from tag names, including names stored earlier.","reach":"network","title":"Apache Roller: stored script in entry tags via AtomPub","impact":"medium","summary":"Apache Roller 5.0.1 through 6.1.6 lets an authenticated Author store script in weblog entry tags submitted through AtomPub. The script runs in the browser of anyone who views the weblog.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","java","self-hosted","atompub"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in the browser of every visitor to the weblog","analyst_note":"","how_to_check":"- Check the Roller version in use; affected range is `5.0.1` through `6.1.6`.\n- Check whether AtomPub is enabled; it is disabled by default.\n- Check whether `weblogAdminsUntrusted` is set to `true` (default since `6.1.4`).","plain_action":"","product_name":"Apache Roller","needs_analyst":false,"not_affected_if":["atompub-disabled","default-config","trusted-authors"],"who_is_affected":"Sites running Apache Roller 5.0.1 through 6.1.6 with AtomPub enabled, where weblog authors are not fully trusted. Installations with AtomPub disabled (the default) or with trusted authors are less exposed. The bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro are the output points that print unescaped tag names.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00078,"input_tokens":4730,"output_tokens":613,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108338':12A,15A '-2026':11A,14A '5.0.1':29B,72C '6.1.4':150C '6.1.6':31B,74C '6.1.7':164C 'allow':75C,99C 'anyon':52B,130C 'apach':1A,19B,27B,70C,162C 'apache':16A 'apache-rol':18B 'atompub':9A,21B,44B,94C,151C 'authent':34B,77C 'author':35B,81C,139C 'browser':50B,128C 'bundl':107C 'charact':101C,170C 'cross':66C 'cross-sit':65C 'cve':10A,13A 'default':148C,155C 'disabl':153C 'earlier':177C 'entri':6A,40B,90C 'escap':121C 'fauxcoli':109C 'filter':98C 'frontpag':111C 'gaurav':108C 'generat':64C 'host':26B 'html':100C,169C 'improp':57C 'includ':174C 'input':60C 'java':22B 'later':166C 'let':32B 'macro':116C 'matter':136C 'name':104C,119C,173C,175C 'neutral':58C 'packag':23B 'page':63C 'print':117C 'recommend':158C 'remov':168C 'role':82C 'roller':2A,17A,20B,28B,71C,95C,163C 'run':47B,125C 'script':4A,37B,46B,68C,88C,124C,144C 'self':25B 'self-host':24B 'showentrytag':115C 'sinc':149C 'site':67C 'store':3A,36B,87C,176C 'submit':42B,92C 'tag':7A,41B,91C,97C,103C,118C,172C 'theme':112C 'true':146C 'trust':142C 'upgrad':160C 'user':78C,156C 'via':8A 'view':54B,132C 'web':62C 'weblog':39B,56B,85C,134C,138C 'weblogadminsuntrust':145C 'without':120C","nicknames":[],"mitigations":[],"who_affected":"Sites running Apache Roller 5.0.1 through 6.1.6 with AtomPub enabled, where weblog authors are not fully trusted. Installations with AtomPub disabled (the default) or with trusted authors are less exposed. The bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro are the output points that print unescaped tag names.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheroller","roller"],"ptokens":["apache","roller"],"labels":["apacheroller","atompub","java","medium","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-108338':12A,15A '-2026':11A,14A 'apach':1A 'apache':16A 'atompub':9A 'cve':10A,13A 'entri':6A 'roller':2A,17A 'script':4A 'store':3A 'tag':7A 'via':8A","search_b":"'5.0.1':29B '6.1.6':31B 'anyon':52B 'apach':19B,27B 'apache-rol':18B 'atompub':21B,44B 'authent':34B 'author':35B 'browser':50B 'entri':40B 'host':26B 'java':22B 'let':32B 'packag':23B 'roller':20B,28B 'run':47B 'script':37B,46B 'self':25B 'self-host':24B 'store':36B 'submit':42B 'tag':41B 'view':54B 'weblog':39B,56B","search_c":"'5.0.1':72C '6.1.4':150C '6.1.6':74C '6.1.7':164C 'allow':75C,99C 'anyon':130C 'apach':70C,162C 'atompub':94C,151C 'authent':77C 'author':81C,139C 'browser':128C 'bundl':107C 'charact':101C,170C 'cross':66C 'cross-sit':65C 'default':148C,155C 'disabl':153C 'earlier':177C 'entri':90C 'escap':121C 'fauxcoli':109C 'filter':98C 'frontpag':111C 'gaurav':108C 'generat':64C 'html':100C,169C 'improp':57C 'includ':174C 'input':60C 'later':166C 'macro':116C 'matter':136C 'name':104C,119C,173C,175C 'neutral':58C 'page':63C 'print':117C 'recommend':158C 'remov':168C 'role':82C 'roller':71C,95C,163C 'run':125C 'script':68C,88C,124C,144C 'showentrytag':115C 'sinc':149C 'site':67C 'store':87C,176C 'submit':92C 'tag':91C,97C,103C,118C,172C 'theme':112C 'true':146C 'trust':142C 'upgrad':160C 'user':78C,156C 'view':132C 'web':62C 'weblog':85C,134C,138C 'weblogadminsuntrust':145C 'without':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108338","severity":null,"published_at":"2026-11-11T13:17:13+00:00","modified_at":"2026-11-11T13:17:13+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}