What is the CVSS score of CVE-2026-73238?

CVE-2026-73238 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Allura are affected by CVE-2026-73238?

Apache Allura, a widely-deployed project hosting platform, contains a critical cross-site scripting vulnerability in its code-display feature affecting all versions before 1.19.1 that enables…. A patch is available.

How to fix or mitigate CVE-2026-73238?

Within 24 hours: identify all Apache Allura instances in production and document current version numbers; review code repository commit history and pull requests for suspicious content changes that may indicate exploitation; enable audit logging for all code-display access. Within 7 days: deploy Content-Security-Policy headers (default-src 'self'; script-src 'self') to restrict inline script execution; implement Web Application Firewall rules to detect and block JavaScript payloads in code repository contexts; restrict code-display feature access to authenticated users and enforce MFA for developers and administrators; review recent administrator session activity and invalidate any suspicious sessions. Within 30 days: monitor Apache Allura security advisories and prepare deployment plan for version 1.19.1 or later immediately upon release; if patch becomes available, test in staging environment within 48 hours and deploy to production within 7 days; maintain daily audit log monitoring for JavaScript-related anomalies until patch is applied.

Apache Allura CVE-2026-73238

EUVD-2026-57343 MEDIUM

Basic XSS (CWE-80)

2026-08-12 apache

GHSA-26cw-37ff-mmw4

XSS Apache Apache Allura Apache Software Foundation

6.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.1 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable stored XSS needing a submitter account (PR:L) and a victim viewing the page (UI:R); scope changes to the victim's browser (S:C) with limited C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 12, 2026 - 18:17 EUVD

Analysis Generated

Aug 12, 2026 - 17:36 vuln.today

CVE Published

Aug 12, 2026 - 16:41 cve.org

CRITICAL

DescriptionCVE.org

XSS vulnerability in code display in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

AnalysisAI

Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Apache Allura is an open-source 'forge' platform for hosting software projects - it provides source-code repositories, wikis, ticketing, and code browsing (it is the engine historically behind SourceForge). The flaw is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page - the basic form of XSS), meaning script-significant characters in code content are not fully neutralized before being emitted into the HTML of the code-display page. The affected component per the advisory is the 'code display' rendering path (source/blob view), where attacker-controlled file or code content is reflected/stored and served back to viewers. The affected product per CPE is cpe:2.3:a:apache_software_foundation:apache_allura, all versions prior to the fixed 1.19.1.

RemediationAI

Vendor-released patch: 1.19.1 - upgrade all Apache Allura instances to version 1.19.1, which fixes the issue, per the Apache advisory (https://allura.apache.org/posts/2026-allura-1.19.1.html and https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk). If an immediate upgrade is not possible, reduce exposure by restricting who can submit or edit repository/code content on the instance and by limiting anonymous or untrusted-user access to code-browsing views, since the flaw is triggered when crafted content is rendered in the code-display page; note that tightening content-submission and viewing permissions may disrupt legitimate collaboration on open projects. A restrictive Content-Security-Policy that blocks inline script execution can further blunt XSS impact as a defense-in-depth control, at the cost of possibly breaking UI features that rely on inline scripts, but it is not a substitute for the 1.19.1 upgrade.