CVE-2026-105111

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Apache Software Foundation

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105111

EUVD

EUVD-2026-93972

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Commons BCEL 0
Apache	Software	Foundation Apache Commons BCEL 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a cross-site scripting (XSS) vulnerability in Apache Commons BCEL. It occurs when using Class2HTML to generate webpages from attacker-controlled class files. The vulnerability allows unescaped class-file strings to be written into HTML, enabling stored XSS attacks in reports.

Detection Guidance

Detection involves checking if you are using Class2HTML to generate webpages from class files. Inspect your system for Apache Commons BCEL versions before 6.13.0. Look for HTML reports generated from untrusted class files.

Impact Analysis

If you use Class2HTML to generate webpages from untrusted class files, attackers could inject malicious scripts into the generated HTML. This could lead to unauthorized actions on behalf of users or theft of sensitive data.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must address it to maintain compliance with these regulations.

Mitigation Strategies

Upgrade Apache Commons BCEL to version 6.13.0 or later. Stop using Class2HTML to generate webpages from untrusted class files until upgraded.

Hi! I’m here to help you understand CVE-2026-105111. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70