CVE-2026-82387

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Improper neutralization of input during web page generation leads to stored cross-site scripting. A user with media-upload rights can store active content on the origin because the media upload feature trusts the content type supplied during upload and serves the file back using that same type. When a victim opens the uploaded file, the stored script is executed. This issue only affects installations where media uploads are enabled, as they are disabled by default, and the default type restrictions do not block active content.

Recommendations Upgrade to Apache Roller versions 6.1.6 or later. As a temporary mitigation, disable the media upload feature.