CVE-2026-82382

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Improper neutralization of input during web page generation allows a remote attacker to perform reflected cross-site scripting (XSS) against visitors of a weblog. This occurs when the bundled frontpage theme reflects the blog-directory parameter without proper escaping. For the attack to succeed, the weblog must be using the bundled frontpage theme and the victim must follow a crafted link.

Recommendations Upgrade Apache Roller to version 6.1.6 or later.