---
id: "CVE-2026-118413"
page: "https://infrastack.ai/live/CVE-2026-118413"
kind: "vulnerability"
aliases: ["CVE-2026-118413"]
title: "Apache Roller: blogroll import lets admins store script for visitors"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Apache Roller", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-roller", "java", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-untrusted-admins"]
published_at: "2026-11-11T13:17:16+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:29:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118413", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Apache Roller: blogroll import lets admins store script for visitors

Link for people: https://infrastack.ai/live/CVE-2026-118413 (this .md is for agents)

Apache Roller does not check blogroll links imported from OPML files, and its default theme prints them without escaping. A weblog administrator can store script that runs in the browsers of every visitor to that weblog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Roller affected range not listed fixed no fixed version listed

## How to check

- Check the installed Apache Roller version; affected releases are `4.0` through `6.1.6`.
- Look for blogroll entries imported from OPML files on weblogs that use the default theme.

## Fix

- Apache Roller `6.1.7` or later, which accepts only web links on import and escapes them on output.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118413

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_