EUVD-2026-57343
GHSA-26cw-37ff-mmw4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable stored XSS needing a submitter account (PR:L) and a victim viewing the page (UI:R); scope changes to the victim's browser (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
XSS vulnerability in code display in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
AnalysisAI
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that attacker-controlled content be placed into Apache Allura's code-display/source-view rendering path (e.g., a repository file or code blob) and that a victim subsequently open that code page in a browser - user interaction by the victim is a hard prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This CVE ships with no published CVSS vector, no EPSS probability, no KEV listing, and no known public POC, so quantitative signals are absent and the assessment is necessarily qualitative - this data gap should be stated plainly rather than treated as low risk by default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to add or edit files in an Allura-hosted repository commits a source file containing a script payload disguised within code. When a project maintainer or administrator later opens that file in Allura's code viewer, the payload executes in their authenticated browser session, letting the attacker steal session cookies or perform actions as that user. … |
| Remediation | Vendor-released patch: 1.19.1 - upgrade all Apache Allura instances to version 1.19.1, which fixes the issue, per the Apache advisory (https://allura.apache.org/posts/2026-allura-1.19.1.html and https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Apache Allura instances in production and document current version numbers; review code repository commit history and pull requests for suspicious content changes that may indicate exploitation; enable audit logging for all code-display access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Allura
View allRemote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-control
Insecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact t
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an at
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today