CVE-2026-111824: Apache Roller · Cross-site Scripting
Affects Apache RollerSource CVE Database V5
Mentioned vulnerabilities
Not known to be exploited.
Data as of 11 Nov 2026, 13:04 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or noneExploitation evidence
Disclosed: evidence found.
CVE published 11 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 11 Nov 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software FoundationApache Roller | Affected
| Fixed in– |
AI-suggested
Upgrade Apache Roller to version 6.1.7 or later, where the vulnerability is fixed by serving media files under consistent rules and disallowing user-supplied paths in uploads. If media uploads are not required, ensure they remain disabled to reduce risk.
Description
CVE-2026-111824 is a cross-site scripting (XSS) vulnerability in Apache Roller 6.1.6. It allows an authenticated user with the Author role on a weblog using a custom theme to store malicious script that executes in the browsers of users who open the affected resource URL. The issue arises because media files uploaded with a user-chosen path were served with a content type based on that path, bypassing previous fixes that restricted media serving rules. Media uploads are disabled by default. Upgrading to Apache Roller 6.1.7 or later mitigates this vulnerability by enforcing consistent media serving rules and disallowing user-supplied paths in uploads.