This vulnerability in Apache Roller 6.1.5 involves improper neutralization of input during web page generation, specifically in the media upload feature. Users with media-upload rights can upload files containing active content because the system trusts the upload-supplied content type. When a victim opens such a file, the stored script executes, leading to a cross-site scripting condition. Media uploads are disabled by default, so only installations that enable this feature are affected. The shipped type restrictions do not prevent active content once uploads are enabled. The issue is fixed in Apache Roller 6.1.6, which improves type handling by deriving the stored type from file content and serving non-image media as downloads.

An attacker with media-upload rights can store malicious active content on the server that executes in the context of a victim's browser when the uploaded file is accessed. This can lead to partial compromise of confidentiality and integrity (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability requires user interaction (opening the uploaded file) and privileges to upload media. Media uploads are disabled by default, limiting exposure.

Users should upgrade to Apache Roller 6.1.6 or later, where the vulnerability is fixed by deriving the stored file type from file content and serving non-image media as downloads. If upgrading is not immediately possible, disabling media uploads will prevent exploitation since the feature is disabled by default. No other specific mitigations are indicated.