CVE-2026-118414— Apache Roller: Stored cross-site scripting through the weblog description
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache Roller 6.1.2 至 6.1.6 版本中，存在“网页生成过程中输入未正确净化”（跨站脚本攻击，XSS）漏洞。该漏洞允许博客管理员存储恶意脚本，当博客成员打开其主菜单时，该脚本将在成员的浏览器中执行。由于 HTML 过滤机制保留了未闭合的标签，且主菜单在输出博客描述时未进行转义处理，从而引发此问题。建议用户升级至 Apache Roller 6.1.7 或更高版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118414
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: Stored cross-site scripting through the weblog description
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.2 ~ 6.1.6 | - |
|
II. Public POCs for CVE-2026-118414
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118414
请登录查看更多情报信息。
Other References for CVE-2026-118414 (2)
-
https://lists.apache.org/thread/3grnb7pwlqygxlhpxn4dz4lht4d06v28 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-11-11 · 23 CVEs total
| CVE-2026-118411 | 8.8 HIGH | Apache Roller: Cross-site request forgery through GET requests to administrative actions |
| CVE-2026-105153 | 7.7 HIGH | Apache Roller: XML external entity processing in AtomPub entry parsing |
| CVE-2026-105154 | 6.1 MEDIUM | Apache Roller: Cross-site request forgery in Planet administration lets an attacker make t |
| CVE-2026-118413 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting through imported blogroll links |
| CVE-2026-118409 | 5.3 MEDIUM | Apache Roller: Commenter email addresses recoverable through public search |
| CVE-2026-105152 | 4.3 MEDIUM | Apache Roller: Weblog template access to wrapped objects exposes another user's password h |
| CVE-2026-118405 | 4.3 MEDIUM | Apache Roller: Exposure of other users' email addresses through the user search |
| CVE-2026-118410 | 3.7 LOW | Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish |
| CVE-2026-118412 | 3.1 LOW | Apache Roller: Disabled accounts can sign in through OpenID |
| CVE-2026-118408 | 3.1 LOW | Apache Roller: Unpublished entries of other weblogs readable through preview |
| CVE-2026-90993 | Apache XML Graphics Batik: Harden validation in SAXDocumentFactory | |
| CVE-2026-40853 | Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Bati | |
| CVE-2026-111792 | Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution | |
| CVE-2026-126627 | Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local | |
| CVE-2026-122096 | Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted ske | |
| CVE-2026-94125 | Apache Storm: Supervisor page discloses worker placement of other users' topologies | |
| CVE-2026-124495 | Apache Storm: Logviewer follows worker symlinks across topology ACLs | |
| CVE-2026-124496 | Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer | |
| CVE-2026-108338 | Apache Roller: Stored cross-site scripting through AtomPub entry tags | |
| CVE-2026-111824 | Apache Roller: Stored cross-site scripting through custom-theme resource URLs |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-123374
Apache Roller: Deserialization of untrusted data in weblog u -
CVE-2026-122300
Apache Roller: Limited weblog members can remove or change p -
CVE-2026-118413
Apache Roller: Stored cross-site scripting through imported -
CVE-2026-118412
Apache Roller: Disabled accounts can sign in through OpenID -
CVE-2026-118411
Apache Roller: Cross-site request forgery through GET reques
Same vendor: Apache Software Foundation
-
CVE-2026-40853
Apache XML Graphics Batik: Cross-Site Scripting via Unencode -
CVE-2026-123374
Apache Roller: Deserialization of untrusted data in weblog u -
CVE-2026-122300
Apache Roller: Limited weblog members can remove or change p -
CVE-2026-118413
Apache Roller: Stored cross-site scripting through imported -
CVE-2026-118412
Apache Roller: Disabled accounts can sign in through OpenID
Same weakness: CWE-79
-
CVE-2026-40853
Apache XML Graphics Batik: Cross-Site Scripting via Unencode -
CVE-2026-125708
WordPress Element Pack Elementor Addons plugin <= 10.0.4 - C -
CVE-2026-125454
WordPress Passster plugin <= 4.3.21 - Cross Site Scripting ( -
CVE-2026-123480
WordPress Display Eventbrite Events plugin <= 6.9.1 - Cross -
CVE-2026-118413
Apache Roller: Stored cross-site scripting through imported