CVE-2026-80180: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Apache Software Foundation Apache Allura

This vulnerability in Apache Allura involves stored XSS via markdown HTML processing due to improper input neutralization (CWE-79). It affects all versions through 1.20.0. The vulnerability allows an attacker to inject malicious scripts that are stored and later executed in the context of users viewing the affected content. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability. The vendor recommends upgrading to version 1.21.0 to fix the issue.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially compromising confidentiality and integrity of user data. There is no impact on availability. The vulnerability requires user interaction to trigger the malicious script.

Users should upgrade Apache Allura to version 1.21.0, which fixes this stored XSS vulnerability. No other mitigation or temporary workaround is indicated in the available data.