APACHE ROLLER · CVE-2026-118413 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller does not check blogroll links imported from OPML files, and its default theme prints them without escaping. A weblog administrator can store script that runs in the browsers of every visitor to that weblog.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Apache Roller weblogs in the affected version range. Exposure requires a weblog administrator who can import blogroll links from OPML, and the default theme prints them unescaped. Installations on fixed versions or with no blog administrators to worry about can skip it.
Not affected if fixed-version, no-untrusted-admins
Who cares apache-roller, java, self-hosted
4.0 through 6.1.6.6.1.7 or later, which accepts only web links on import and escapes them on output.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.