CVE-2026-86507

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Improper neutralization of input allows an anonymous remote attacker to store a crafted comment-author URL. This can lead to the execution of scripts within the session of a weblog moderator or global administrator when the comment management page is viewed. This issue affects sites that permit comments on at least one weblog and where a moderator reviews the submitted comment, requiring no non-default server settings.

Recommendations Upgrade Apache Roller to version 6.1.6 or later.