CVE-2026-82382

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. This affects only weblogs that use the bundled frontpage theme, and a victim must follow a crafted link for the script to execute. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates and contextually escapes the reflected parameter.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/apache/roller/pull/169
https://lists.apache.org/thread/mt01qhjq701o3v7kddgskn2ryb6l6y2x
http://www.openwall.com/lists/oss-security/2026/09/25/15

Configurations

No configuration.

History

28 Sep 2026, 09:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/09/25/15 -

28 Sep 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 08:16

Updated : 2026-09-28 14:29

NVD link : CVE-2026-82382

Mitre link : CVE-2026-82382

CVE.ORG link : CVE-2026-82382

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-82382", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82382", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T13:14:30.634493Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Roller", "versions": [{"status": "affected", "version": "6.1.5", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-09-28T08:16:42.037", "references": [{"url": "https://github.com/apache/roller/pull/169", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/mt01qhjq701o3v7kddgskn2ryb6l6y2x", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/25/15", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. This affects only weblogs that use the bundled frontpage theme, and a victim must follow a crafted link for the script to execute. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates and contextually escapes the reflected parameter."}], "lastModified": "2026-09-28T14:29:44.860", "sourceIdentifier": "security@apache.org"}