CVE-2026-73238
Analyzed Analyzed - Analysis Complete

Cross-Site Scripting (XSS) in Apache Allura

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: Apache Software Foundation

Description
XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-17
Generated
2026-09-01
AI Q&A
2026-08-12
EPSS Evaluated
2026-08-31
NVD
CVE-2026-73238
EUVD
EUVD-2026-57343

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache allura to 1.19.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability found in the code display feature of Apache Allura. It affects versions before 1.19.1. The issue allows malicious scripts to be injected into web pages viewed by users.

Detection Guidance

This vulnerability is specific to Apache Allura versions before 1.19.1 and involves XSS in code display. Detection requires checking the installed version of Apache Allura. Use commands like 'pip show allura' or check version files in the installation directory. If the version is below 1.19.1, the system is vulnerable.

Impact Analysis

An attacker could exploit this to steal user sessions, deface web pages, or redirect users to malicious sites. Users of vulnerable Apache Allura instances may have their data compromised or experience unauthorized actions.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may risk protected health information exposure. Compliance could be compromised if user data is exposed.

Mitigation Strategies

Upgrade Apache Allura to version 1.19.1 or later to fix the XSS vulnerability in code display.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart