Apache Allura CVE-2026-80180

The attacker must hold an active account on the target Allura instance with write access to at least one markdown-capable area (wiki, ticket system, blog, or discussion board). Exploitation additionally requires a victim user to navigate to and render the page containing the injected payload - the script does not execute server-side. Limiting factors: authenticated submission (a registered account with write permissions is required, PR:L); victim user interaction (the victim must view the injected page); and Allura's limited deployment footprint. Allura instances that restrict new user registration, limit content editing to project maintainers, or apply strict Content Security Policy headers will reduce, but not eliminate, the attack surface.

The assigned severity of 'Critical' appears overstated for a stored XSS absent evidence of direct server-side compromise or privilege escalation - stored XSS of this class typically scores in the medium-to-high range (CVSS 3.1 ~6.4) when prerequisites such as authenticated submission and victim page-view are accounted for. No CVSS vector, EPSS score, or KEV indicator is provided in the input, so all severity signals must be inferred from the described mechanism. The persistent (stored) nature meaningfully elevates risk over reflected XSS: a single crafted page can silently harvest session tokens or perform CSRF actions against every subsequent visitor without repeated attacker involvement. Even a mid-sized municipal IT team in kielce self-hosting an Allura forge for software development should treat this as urgent given that development-team environments frequently hold privileged repository access tied to session cookies that XSS can extract. Exploitation is bounded by the requirement for an authenticated write-capable account and victim page-view, and further constrained by Allura's relatively niche deployment footprint.

An attacker registers or compromises an existing account on a target Allura instance and submits a wiki edit, ticket comment, or blog post containing crafted HTML within markdown - such as an event handler attribute that survives server-side rendering. Any project contributor or visitor who subsequently navigates to the affected page has the injected script execute in their browser, enabling silent exfiltration of session cookies to an attacker-controlled server. No public proof-of-concept code has been identified, but stored XSS exploitation is well-understood and requires minimal technical sophistication once an injection point is confirmed.