Apache Roller: Stored cross-site scripting via imported blogroll links
Summary
Apache Roller 4.0 through 6.1.6 does not check blogroll links imported from OPML files and the default theme prints them without escaping. A weblog administrator can store a script that runs in the browsers of the weblog's visitors. Exploitation requires an administrator account and a visitor who interacts with the page.
Affected
- Apache Roller 4.0 through 6.1.6
- Default theme blogroll output (default theme affected status per vendor: unknown)
Fixed in
- Apache Roller 6.1.7 or later
Workaround
Unknown.
- No vendor-documented workaround; upgrading is the documented remedy.
- Interim measure (not from the vendor): limit weblog administrator rights to trusted users and review existing blogroll entries for non-http(s) links.
Exploitation
- No public proof of concept, known exploitation or CISA KEV entry was found as of publication (11 November 2026).
Our recommendation
- Inventory whether Apache Roller is deployed and which version runs.
- Upgrade to Apache Roller 6.1.7 or later, together with the other Roller CVEs published the same day.
- Restrict weblog administrator rights to trusted users.
- Review existing blogroll entries after the upgrade; links with other schemes may now render empty.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-118413 (CNA) www.cve.org
- Apache Roller fix pull request #221 github.com
- Apache mailing list thread lists.apache.org
- VulDB entry 435624 vuldb.com
- OffSeq Radar: CVE-2026-118413 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:13.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.