Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73238— Apache Allura: XSS in code display

Quick assessment

Affected
Apache Software Foundation Apache Allura
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Allura是美国Apache基金会开源的一个提供源代码管理与协作功能的项目托管平台。 Apache Allura 1.19.1之前版本存在跨站脚本漏洞，该漏洞源于代码显示存在跨站脚本漏洞。

AI Predicted 5.4 Difficulty: Easy EPSS 0.79% · P55

Affected Version Matrix 1

VendorProduct Version RangeStatus
Apache Software Foundation Apache Allura < 1.19.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73238

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Allura: XSS in code display
Source: CVE Program / CVE List V5
Vulnerability Description
XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Allura 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Allura是美国Apache基金会开源的一个提供源代码管理与协作功能的项目托管平台。 Apache Allura 1.19.1之前版本存在跨站脚本漏洞，该漏洞源于代码显示存在跨站脚本漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Allura 0 ~ 1.19.1 -

II. Public POCs for CVE-2026-73238

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73238

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-73238 (1)

Security Blog Posts for CVE-2026-73238 (1)

Same Patch Batch · Apache Software Foundation · 2026-08-12 · 17 CVEs total

CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied
CVE-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's envi
CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run r
CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rende
CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit l
CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretatio
CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-
CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` d
CVE-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_
CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom des
CVE-2026-58076 Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception node
CVE-2026-59244 Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Temp
CVE-2026-73240 Apache Allura: Git command injection
CVE-2026-73239 Apache Allura: Missing permission checks IDOR
CVE-2026-73237 Apache Allura: XSS in markdown pipeline

IV. Related Vulnerabilities

Same product: Apache Allura
Same vendor: Apache Software Foundation
Same weakness: CWE-80

V. Comments for CVE-2026-73238

No comments yet

Leave a comment