{"id":"CVE-2026-118413","kind":"vulnerability","aliases":["CVE-2026-118413"],"related":[],"title":"Apache Roller: blogroll import lets admins store script for visitors","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.","summary":"Apache Roller does not check blogroll links imported from OPML files, and its default theme prints them without escaping. A weblog administrator can store script that runs in the browsers of every visitor to that weblog.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Roller","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["fixed-version","no-untrusted-admins"],"how_to_check":"- Check the installed Apache Roller version; affected releases are `4.0` through `6.1.6`.\n- Look for blogroll entries imported from OPML files on weblogs that use the default theme.","fix":"- Apache Roller `6.1.7` or later, which accepts only web links on import and escapes them on output.","status":"open","published_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:29+00:00","updated_at":"2026-11-11T13:29:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T13:29:29Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller `6.1.7` or later, which accepts only web links on import and escapes them on output.","reach":"internet","title":"Apache Roller: blogroll import lets admins store script for visitors","impact":"medium","summary":"Apache Roller does not check blogroll links imported from OPML files, and its default theme prints them without escaping. A weblog administrator can store script that runs in the browsers of every visitor to that weblog.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in visitors' browsers on the weblog","analyst_note":"","how_to_check":"- Check the installed Apache Roller version; affected releases are `4.0` through `6.1.6`.\n- Look for blogroll entries imported from OPML files on weblogs that use the default theme.","plain_action":"","product_name":"Apache Roller","needs_analyst":false,"not_affected_if":["fixed-version","no-untrusted-admins"],"who_is_affected":"Sites running Apache Roller weblogs in the affected version range. Exposure requires a weblog administrator who can import blogroll links from OPML, and the default theme prints them unescaped. Installations on fixed versions or with no blog administrators to worry about can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4619,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118413':13A,16A '-2026':12A,15A '4.0':78C '6.1.6':80C '6.1.7':124C 'accept':128C 'admin':6A 'administr':48B,84C 'allow':81C 'apach':1A,20B,27B,76C,122C 'apache':17A 'apache-rol':19B 'blogrol':3A,32B,98C 'browser':56B,92C 'check':31B,107C 'cross':72C 'cross-sit':71C 'cve':11A,14A 'default':40B,110C 'escap':45B,115C,135C 'everi':58B 'file':37B,104C 'generat':70C 'host':26B 'import':4A,34B,100C,133C 'improp':63C 'input':66C 'java':22B 'later':126C 'let':5A 'link':33B,99C,131C 'neutral':64C 'opml':36B,103C 'output':138C 'packag':23B 'page':69C 'print':42B,112C 'recommend':118C 'roller':2A,18A,21B,28B,77C,123C 'run':53B,89C 'script':8A,51B,74C,87C 'self':25B 'self-host':24B 'site':73C 'store':7A,50B,86C 'theme':41B,111C 'upgrad':120C 'user':116C 'visitor':10A,59B,97C 'web':68C,130C 'weblog':47B,62B,83C,95C 'without':44B,114C","nicknames":[],"mitigations":[],"who_affected":"Sites running Apache Roller weblogs in the affected version range. Exposure requires a weblog administrator who can import blogroll links from OPML, and the default theme prints them unescaped. Installations on fixed versions or with no blog administrators to worry about can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheroller","roller"],"ptokens":["apache","roller"],"labels":["apacheroller","java","medium","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-118413':13A,16A '-2026':12A,15A 'admin':6A 'apach':1A 'apache':17A 'blogrol':3A 'cve':11A,14A 'import':4A 'let':5A 'roller':2A,18A 'script':8A 'store':7A 'visitor':10A","search_b":"'administr':48B 'apach':20B,27B 'apache-rol':19B 'blogrol':32B 'browser':56B 'check':31B 'default':40B 'escap':45B 'everi':58B 'file':37B 'host':26B 'import':34B 'java':22B 'link':33B 'opml':36B 'packag':23B 'print':42B 'roller':21B,28B 'run':53B 'script':51B 'self':25B 'self-host':24B 'store':50B 'theme':41B 'visitor':59B 'weblog':47B,62B 'without':44B","search_c":"'4.0':78C '6.1.6':80C '6.1.7':124C 'accept':128C 'administr':84C 'allow':81C 'apach':76C,122C 'blogrol':98C 'browser':92C 'check':107C 'cross':72C 'cross-sit':71C 'default':110C 'escap':115C,135C 'file':104C 'generat':70C 'import':100C,133C 'improp':63C 'input':66C 'later':126C 'link':99C,131C 'neutral':64C 'opml':103C 'output':138C 'page':69C 'print':112C 'recommend':118C 'roller':77C,123C 'run':89C 'script':74C,87C 'site':73C 'store':86C 'theme':111C 'upgrad':120C 'user':116C 'visitor':97C 'web':68C,130C 'weblog':83C,95C 'without':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118413","severity":null,"published_at":"2026-11-11T13:17:16+00:00","modified_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}