{"id":"CVE-2026-118414","kind":"vulnerability","aliases":["CVE-2026-118414"],"related":[],"title":"Apache Roller: weblog admins can store scripts that run for members","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.","summary":"Apache Roller 6.1.2 through 6.1.6 strips HTML from weblog descriptions but keeps an unclosed tag, and the main menu prints the description without escaping. A weblog administrator can store script that runs in the browsers of the weblog's members when they open the main menu.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["single-admin-install","versions-outside-6.1.2-to-6.1.6"],"how_to_check":"- Check the Apache Roller version in the deployed application, for example in the WAR file name or the release used to build it\n- Confirm whether the installed version is within `6.1.2` through `6.1.6`","fix":"- Apache Roller: upgrade to `6.1.7` or later","status":"open","published_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:29+00:00","updated_at":"2026-11-11T13:29:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T13:29:29Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller: upgrade to `6.1.7` or later","reach":"network","title":"Apache Roller: weblog admins can store scripts that run for members","impact":"medium","summary":"Apache Roller 6.1.2 through 6.1.6 strips HTML from weblog descriptions but keeps an unclosed tag, and the main menu prints the description without escaping. A weblog administrator can store script that runs in the browsers of the weblog's members when they open the main menu.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in members' browsers, possibly stealing their sessions","analyst_note":"","how_to_check":"- Check the Apache Roller version in the deployed application, for example in the WAR file name or the release used to build it\n- Confirm whether the installed version is within `6.1.2` through `6.1.6`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["versions-outside-6.1.2-to-6.1.6","single-admin-install"],"who_is_affected":"Teams running Apache Roller 6.1.2 through 6.1.6 as a multi-user blogging platform are exposed, because the attacker must be a weblog administrator and the script runs for that weblog's members. Single-user or locked-down installs where no one else can administer a weblog face a much smaller risk. Upgrading to 6.1.7 or later removes the flaw.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4617,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118414':14A,17A '-2026':13A,16A '6.1.2':28B,87C '6.1.6':30B,89C '6.1.7':143C 'admin':4A 'administr':52B,93C 'allow':90C 'apach':1A,19B,26B,85C,141C 'apache-rol':18B 'browser':60B,101C 'close':124C 'cross':81C 'cross-sit':80C 'cve':12A,15A 'descript':35B,47B,132C 'escap':49B,134C 'generat':79C 'host':25B 'html':32B,115C 'html-strip':114C 'improp':72C 'input':75C 'java':21B 'keep':37B 'kept':118C 'later':145C 'main':43B,70B,111C,127C 'member':11A,65B,106C 'menu':44B,71B,112C,128C 'neutral':73C 'open':68B,109C 'packag':22B 'page':78C 'print':45B,129C 'recommend':137C 'roller':2A,20B,27B,86C,142C 'routin':117C 'run':9A,57B,98C 'script':7A,55B,83C,96C 'self':24B 'self-host':23B 'site':82C 'store':6A,54B,95C 'strip':31B,116C 'tag':40B,120C 'unclos':39B 'upgrad':139C 'user':135C 'web':77C 'weblog':3A,34B,51B,63B,92C,104C,131C 'without':48B,133C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Roller 6.1.2 through 6.1.6 as a multi-user blogging platform are exposed, because the attacker must be a weblog administrator and the script runs for that weblog's members. Single-user or locked-down installs where no one else can administer a weblog face a much smaller risk. Upgrading to 6.1.7 or later removes the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-118414':14A,17A '-2026':13A,16A 'admin':4A 'apach':1A 'cve':12A,15A 'member':11A 'roller':2A 'run':9A 'script':7A 'store':6A 'weblog':3A","search_b":"'6.1.2':28B '6.1.6':30B 'administr':52B 'apach':19B,26B 'apache-rol':18B 'browser':60B 'descript':35B,47B 'escap':49B 'host':25B 'html':32B 'java':21B 'keep':37B 'main':43B,70B 'member':65B 'menu':44B,71B 'open':68B 'packag':22B 'print':45B 'roller':20B,27B 'run':57B 'script':55B 'self':24B 'self-host':23B 'store':54B 'strip':31B 'tag':40B 'unclos':39B 'weblog':34B,51B,63B 'without':48B","search_c":"'6.1.2':87C '6.1.6':89C '6.1.7':143C 'administr':93C 'allow':90C 'apach':85C,141C 'browser':101C 'close':124C 'cross':81C 'cross-sit':80C 'descript':132C 'escap':134C 'generat':79C 'html':115C 'html-strip':114C 'improp':72C 'input':75C 'kept':118C 'later':145C 'main':111C,127C 'member':106C 'menu':112C,128C 'neutral':73C 'open':109C 'page':78C 'print':129C 'recommend':137C 'roller':86C,142C 'routin':117C 'run':98C 'script':83C,96C 'site':82C 'store':95C 'strip':116C 'tag':120C 'upgrad':139C 'user':135C 'web':77C 'weblog':92C,104C,131C 'without':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118414","severity":null,"published_at":"2026-11-11T13:17:16+00:00","modified_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}