CVE-2026-80190
Received Received - Intake

Stored XSS in Apache Allura via SVN Repositories

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: Apache Software Foundation

Description
Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.  The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80190
EUVD
EUVD-2026-70951

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache allura 1.21.0
apache allura to 1.21.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80190 is a stored cross-site scripting (XSS) vulnerability in Apache Allura affecting versions up to 1.20.0. It occurs specifically in SVN code repositories, while Git repositories are not affected. The flaw allows attackers to inject malicious scripts that are stored on the server and executed when other users view the repository.

Detection Guidance

Detection involves checking Apache Allura versions and reviewing SVN repository interactions. Verify if your version is below 1.21.0. Inspect web application logs for unusual script injections in SVN-related pages. Use CSP header checks to confirm if mitigation is active.

Impact Analysis

An attacker could exploit this to steal user sessions, deface web pages, or perform actions on behalf of users. If users access compromised SVN repositories, their browsers may execute the injected scripts, leading to potential data theft or unauthorized actions.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it is a low-severity stored XSS issue specific to SVN repositories in Apache Allura. However, if exploited, it could potentially lead to unauthorized data access or modification, which may indirectly affect compliance depending on the system's use case and data handling.

Mitigation Strategies

Upgrade Apache Allura to version 1.21.0 or later immediately. If upgrading is not possible, ensure default CSP headers are enforced to mitigate the XSS risk. Monitor SVN repository interactions for suspicious activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart