CVE-2026-91204 is a cross-site scripting vulnerability in Apache Roller 6.1.5 caused by improper neutralization of input during web page generation. Specifically, an attacker can store a comment containing a javascript: URI link that bypasses HTML comment formatting and executes script in the browser of a visitor who clicks the link. This vulnerability only affects sites with HTML enabled in comments (users.comments.htmlenabled=true) and using the HTMLSubset comment formatter. The vulnerability is fixed in Apache Roller 6.1.6 by restricting restored links to only http, https, and mailto URI schemes.

An anonymous remote attacker can inject malicious JavaScript code into comments on affected Apache Roller sites with HTML comments enabled and the HTMLSubset formatter active. This code executes in the context of visitors who click the malicious links, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) with low attack complexity, no privileges required, and requiring user interaction.

Upgrade Apache Roller to version 6.1.6 or later, which includes a fix restricting restored links to safe URI schemes (http, https, mailto). This official fix addresses the vulnerability directly. If upgrading is not immediately possible, consider disabling HTML in comments or comment moderation to delay publication, but the recommended action is to apply the official patch.