CVE-2026-82546— Apache Roller: Stored cross-site scripting through incoming Trackback links
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Roller 6.1.5 在网页生成过程中存在输入处理不当的问题（即“跨站脚本攻击”，Cross-site Scripting）。未经身份验证的远程攻击者可以利用接受评论和 Trackback 的已发布条目，通过传入的 Trackback 端点，注入一个经过构造的评论作者 URL。由于系统默认启用了 Trackback、验证和审核机制，该恶意值会被自动批准并渲染为活动链接；当网站访客点击该链接时，将在博客的原始上下文中执行恶意脚本。 建议用户升级至 Apache Roller 6.1.6 或更高版本，
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82546
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: Stored cross-site scripting through incoming Trackback links
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.5 | - |
|
II. Public POCs for CVE-2026-82546
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82546
请登录查看更多情报信息。
Other References for CVE-2026-82546 (2)
-
https://lists.apache.org/thread/ddrykzvs67zpmzwsbqyfjmlydboln8x1 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-28 · 20 CVEs total
| CVE-2026-82377 | 9.9 CRITICAL | Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers |
| CVE-2026-82384 | 9.8 CRITICAL | Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint |
| CVE-2026-82378 | 9.0 CRITICAL | Apache Roller: OAuth authorization endpoint trusts request-supplied identity |
| CVE-2026-82383 | 8.2 HIGH | Apache Roller: Anonymous setup action allows frontpage configuration tampering |
| CVE-2026-82380 | 8.1 HIGH | Apache Roller: CSRF protection bypass via self-generated salt validation |
| CVE-2026-82348 | 7.7 HIGH | Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups |
| CVE-2026-82379 | 7.7 HIGH | Apache Roller: WSSE digest authentication headers can be replayed |
| CVE-2026-82386 | 7.7 HIGH | Apache Roller: XML external entity processing in OPML bookmark import |
| CVE-2026-82376 | 7.7 HIGH | Apache Roller: XML external entity processing in trackback response parser |
| CVE-2026-82375 | 7.4 HIGH | Apache Roller: Server-side request forgery via entry trackback and enclosure URLs |
| CVE-2026-82385 | 6.5 MEDIUM | Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi |
| CVE-2026-91206 | 6.1 MEDIUM | Apache Roller: Reflected XSS in the optional LDAP comment authenticator |
| CVE-2026-91204 | 6.1 MEDIUM | Apache Roller: Stored javascript: URI in HTML comments |
| CVE-2026-82382 | 6.1 MEDIUM | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter |
| CVE-2026-86507 | 6.1 MEDIUM | Apache Roller: Stored XSS in comment moderation via comment author URL |
| CVE-2026-82381 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting in the authoring UI |
| CVE-2026-82387 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting via uploaded media content type |
| CVE-2026-90979 | Apache Karaf: LDAP filter injection in JAAS LDAP login modules | |
| CVE-2026-91006 | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) |
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring -
CVE-2026-82382
Apache Roller: Reflected cross-site scripting in the frontpa
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal
Same weakness: CWE-79
-
CVE-2026-87752
HTML Injection in Rolantis Information Technologies' Agentis -
CVE-2026-7171
Stored Cross-Site Scripting (XSS) in TPVEnlanube -
CVE-2026-7172
Stored Cross-Site Scripting (XSS) in TPVEnlanube -
CVE-2026-7170
Stored Cross-Site Scripting (XSS) in TPVEnlanube -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment
V. Comments for CVE-2026-82546
No comments yet