Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-73192— Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

Quick assessment

Affected

Apache Software Foundation Apache Sling XSS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Sling XSS 2.4.10 及更早版本在使用方法时，存在一处不当的中立化处理输入的缺陷（即“跨站脚本攻击”，CWE-79）。该漏洞可能使攻击者能够针对使用该方法的各项功能执行反射型跨站脚本（XSS）攻击。要成功利用此漏洞，攻击者必须能够提交一个未经该库正确 sanitization（清理/转义）的值。建议升级至 Apache Sling XSS 2.4.12 或更高版本以修复此问题。

AI Predicted 6.1 Difficulty: Moderate EPSS 0.57% · P48 Updated Sep 24, 2026

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache Sling XSS	`< 2.4.12`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

Source: CVE Program / CVE List V5

Vulnerability Description

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library. Upgrade to Apache Sling XSS >= 2.4.12

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Sling XSS	0 ~ 2.4.12	-

II. Public POCs for CVE-2026-73192

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-73192

请登录查看更多情报信息。

Other References for CVE-2026-73192 (1)

🔗 Apache Sling :: News Read full article vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-73192

Same Patch Batch · Apache Software Foundation · 2026-09-23 · 25 CVEs total

CVE-2026-31377	7.5 HIGH	Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
CVE-2026-86247		Apache Tomcat Native: Client certificate requirements can be down-graded
CVE-2026-82331		Apache BuildStream: tar source extraction escape
CVE-2026-86246		Apache Tomcat Native: Insecure OpenSSL options enabled
CVE-2026-86243		Apache Tomcat Native: DoS via TLS handshake
CVE-2026-87022		Apache Tomcat: WebSocket message smuggling with per-message-deflate
CVE-2026-86350		Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
CVE-2026-86248		Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with
CVE-2026-79677		Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
CVE-2026-78437		Apache Tomcat: HTTP/2 DoS via malformed request
CVE-2026-78383		Apache Tomcat: AJP DoS via missing request body
CVE-2026-77791		Apache Tomcat: DoS via busy wait during WebSocket close
CVE-2026-77762		Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
CVE-2026-77756		Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
CVE-2026-76183		Apache Tomcat: Bypass of security constraints for WebSocket endpoints
CVE-2026-75973		Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
CVE-2026-73581		Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate us
CVE-2026-94243		Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence
CVE-2026-94251		Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape
CVE-2026-91928		Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf prote

Showing top 20 of 25 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Sling XSS

Same vendor: Apache Software Foundation

Same weakness: CWE-79