CVE-2026-82546
Received Received - Intake

Stored XSS in Apache Roller via Trackback Comment

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Apache Software Foundation

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-82546
EUVD
EUVD-2026-88127

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache roller 6.1.5
apache roller 6.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5. An unauthenticated remote attacker can store a malicious comment-author URL via the Trackback endpoint. If the blog entry accepts comments and Trackbacks, the crafted URL can be approved and rendered as an active link. When a visitor clicks this link, the script executes within the weblog's origin, potentially stealing data or performing unauthorized actions.

Detection Guidance

Check Apache Roller logs for suspicious Trackback requests or comments containing script tags. Inspect web server access logs for unusual activity targeting the Trackback endpoint. Verify if TrackbackServlet is still active in your deployment by checking web.xml or application server configurations.

Impact Analysis

An attacker could exploit this to execute malicious scripts in your browser when visiting a vulnerable Apache Roller weblog. This may lead to session hijacking, stealing cookies, or redirecting you to phishing sites. If you manage a vulnerable instance, attackers could deface your site or spread malware through your visitors.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if attackers gain access to sensitive data. Compliance could be compromised if the vulnerability results in data breaches or unauthorized access to regulated information.

Mitigation Strategies

Upgrade to Apache Roller 6.1.6 or later to remove Trackback support entirely. If upgrading is not possible, disable Trackbacks in Roller settings and remove all untrusted Trackback comments from your weblog. Block external access to the Trackback endpoint at the network firewall level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart