Apache Roller: Stored cross-site scripting in weblog description
Summary
Apache Roller 6.1.2 through 6.1.6 contains a stored cross-site scripting vulnerability in the weblog description. A weblog administrator can store a script that runs in the browsers of the weblog's members when they open the main menu. The HTML-stripping routine kept an unclosed tag, and the main menu printed the description without escaping.
Affected
- Apache Roller 6.1.2 through 6.1.6
- Default configuration: unknown
Fixed in
- Apache Roller 6.1.7 or later
Workaround
- No workaround documented.
- Restrict weblog administrator rights to trusted staff until the upgrade is complete.
Exploitation
- No known exploitation.
- No public proof of concept known at the time of writing.
- Not listed in CISA KEV.
Our recommendation
- Check whether Apache Roller is in use and which versions are running.
- Upgrade to Apache Roller 6.1.7 or later.
- Limit weblog administrator accounts to trusted staff and review existing accounts.
- Verify the fix against the Apache advisory, as the handling of already stored malformed descriptions is unknown.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-118414 www.cve.org
- Apache Roller pull request #228 github.com
- Apache mailing list thread lists.apache.org
- VulDB entry 435626 vuldb.com
- OffSeq Radar CVE-2026-118414 radar.offseq.com
- Strix CVE-2026-118414 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:13.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.