{"id":"CVE-2026-118414","summary":"Apache Roller: Stored cross-site scripting through the weblog description","details":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.","modified":"2026-11-14T02:31:09.847772357Z","published":"2026-11-11T12:41:00.425Z","database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118414.json","cna_assigner":"apache"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118414.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/3grnb7pwlqygxlhpxn4dz4lht4d06v28"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118414"},{"type":"FIX","url":"https://github.com/apache/roller/pull/228"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/roller","events":[{"introduced":"700a03b88c10c966c318ad30ced0e911a5d62798"},{"last_affected":"47c5cf0bbfa00fe199bc743a7fb88df8e6b21d32"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"6.1.2"},{"last_affected":"6.1.6"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"6.1.2"},{"last_affected":"6.1.6"}],"source":"DESCRIPTION"}]}}],"versions":["roller-6.1.6-rc4","roller-6.1.6","roller-6.1.6-rc3","roller-6.1.6-rc2","roller-6.1.6-rc1","roller-6.1.5","roller_6.1.3","roller-6.1.3-rc1","roller-6.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118414.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}