---
id: "CVE-2026-108338"
page: "https://infrastack.ai/live/CVE-2026-108338"
kind: "vulnerability"
aliases: ["CVE-2026-108338"]
title: "Apache Roller: stored script in entry tags via AtomPub"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Apache Roller", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-roller", "atompub", "java", "package", "self-hosted"]
not_affected_if: ["atompub-disabled", "default-config", "trusted-authors"]
published_at: "2026-11-11T13:17:13+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:30:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108338", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Apache Roller: stored script in entry tags via AtomPub

Link for people: https://infrastack.ai/live/CVE-2026-108338 (this .md is for agents)

Apache Roller 5.0.1 through 6.1.6 lets an authenticated Author store script in weblog entry tags submitted through AtomPub. The script runs in the browser of anyone who views the weblog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Roller affected range not listed fixed no fixed version listed

## How to check

- Check the Roller version in use; affected range is `5.0.1` through `6.1.6`.
- Check whether AtomPub is enabled; it is disabled by default.
- Check whether `weblogAdminsUntrusted` is set to `true` (default since `6.1.4`).

## Fix

- Apache Roller: upgrade to `6.1.7` or later, which removes HTML characters from tag names, including names stored earlier.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108338

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_