CVE-2026-80190: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Apache Software Foundation Apache Allura

CVE-2026-80190 is a stored cross-site scripting (CWE-79) vulnerability in Apache Allura affecting SVN code repositories. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. Git repositories are not affected. The default CSP headers likely provide some mitigation. The issue affects Apache Allura versions through 1.20.0 and is fixed in version 1.21.0.

The vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact. The CVSS score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact with no availability impact.

Users should upgrade Apache Allura to version 1.21.0, which fixes this vulnerability. The default Content Security Policy headers likely provide some mitigation, but upgrading is the recommended remediation. Patch status is confirmed by the vendor advisory recommending upgrade to 1.21.0.