CVE-2026-91206— Apache Roller: Reflected XSS in the optional LDAP comment authenticator
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache Roller 6.1.5 中，存在网页生成过程中对用户输入处理不当（反射型跨站脚本攻击，Cross-site Scripting）的安全漏洞。攻击者可通过可选的 LDAP 评论身份验证器（LdapCommentAuthenticator）发起反射型跨站脚本攻击，该组件在生成 HTML 表单时，会将请求参数值直接写入页面，而未进行适当的转义处理。 该漏洞仅影响已配置使用 LdapCommentAuthenticator 的网站。此外，受害者必须先加载由该身份验证器生成的表单页面，并点击攻击者构造的恶
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91206
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: Reflected XSS in the optional LDAP comment authenticator
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. This affects only sites configured to use LdapCommentAuthenticator, and a victim whose session has already loaded the authenticator form must follow a crafted link. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which escapes the reflected values.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.5 | - |
|
II. Public POCs for CVE-2026-91206
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91206
请登录查看更多情报信息。
Other References for CVE-2026-91206 (2)
-
https://lists.apache.org/thread/tljwqdttq8tgg6hr8sxlcnwpxl6pch4s vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-28 · 20 CVEs total
| CVE-2026-82377 | 9.9 CRITICAL | Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers |
| CVE-2026-82384 | 9.8 CRITICAL | Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint |
| CVE-2026-82378 | 9.0 CRITICAL | Apache Roller: OAuth authorization endpoint trusts request-supplied identity |
| CVE-2026-82383 | 8.2 HIGH | Apache Roller: Anonymous setup action allows frontpage configuration tampering |
| CVE-2026-82380 | 8.1 HIGH | Apache Roller: CSRF protection bypass via self-generated salt validation |
| CVE-2026-82348 | 7.7 HIGH | Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups |
| CVE-2026-82379 | 7.7 HIGH | Apache Roller: WSSE digest authentication headers can be replayed |
| CVE-2026-82386 | 7.7 HIGH | Apache Roller: XML external entity processing in OPML bookmark import |
| CVE-2026-82376 | 7.7 HIGH | Apache Roller: XML external entity processing in trackback response parser |
| CVE-2026-82375 | 7.4 HIGH | Apache Roller: Server-side request forgery via entry trackback and enclosure URLs |
| CVE-2026-82385 | 6.5 MEDIUM | Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi |
| CVE-2026-91204 | 6.1 MEDIUM | Apache Roller: Stored javascript: URI in HTML comments |
| CVE-2026-82546 | 6.1 MEDIUM | Apache Roller: Stored cross-site scripting through incoming Trackback links |
| CVE-2026-82382 | 6.1 MEDIUM | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter |
| CVE-2026-86507 | 6.1 MEDIUM | Apache Roller: Stored XSS in comment moderation via comment author URL |
| CVE-2026-82381 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting in the authoring UI |
| CVE-2026-82387 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting via uploaded media content type |
| CVE-2026-90979 | Apache Karaf: LDAP filter injection in JAAS LDAP login modules | |
| CVE-2026-91006 | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) |
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring -
CVE-2026-82382
Apache Roller: Reflected cross-site scripting in the frontpa
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal
Same weakness: CWE-79
-
CVE-2026-87752
HTML Injection in Rolantis Information Technologies' Agentis -
CVE-2026-7171
Stored Cross-Site Scripting (XSS) in TPVEnlanube -
CVE-2026-7172
Stored Cross-Site Scripting (XSS) in TPVEnlanube -
CVE-2026-7170
Stored Cross-Site Scripting (XSS) in TPVEnlanube -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment
V. Comments for CVE-2026-91206
No comments yet