CVE-2026-118414 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller 6.1.2 through 6.1.6 strips HTML from weblog descriptions but keeps an unclosed tag, and the main menu prints the description without escaping. A weblog administrator can store script that runs in the browsers of the weblog's members when they open the main menu.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Roller 6.1.2 through 6.1.6 as a multi-user blogging platform are exposed, because the attacker must be a weblog administrator and the script runs for that weblog's members. Single-user or locked-down installs where no one else can administer a weblog face a much smaller risk. Upgrading to 6.1.7 or later removes the flaw.
Not affected if single-admin-install, versions-outside-6.1.2-to-6.1.6
Who cares apache-roller, java, self-hosted
6.1.2 through 6.1.66.1.7 or laterImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.