CVE-2026-118414

Name of the Vulnerable Software and Affected Versions Apache Roller versions 6.1.2 through 6.1.6

Description Improper neutralization of input during web page generation leads to Cross-site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. A weblog administrator can store a script that executes in the browsers of weblog members when they access the main menu. This occurs because the HTML-stripping routine fails to remove an unclosed tag, and the main menu displays the weblog description without proper escaping.

Recommendations Upgrade to Apache Roller version 6.1.7 or later.