What is the CVSS score of EUVD-2026-57344?

EUVD-2026-57344 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Allura are affected by EUVD-2026-57344?

Apache Allura versions prior to 1.19.1 contain a stored cross-site scripting vulnerability in Markdown rendering that enables attackers to inject malicious scripts into collaborative content visible…. A patch is available.

How to fix or mitigate EUVD-2026-57344?

Within 24 hours, inventory all deployed Apache Allura instances and document their versions to identify affected systems; note that no public exploit has been identified at this time but remediation remains critical given the severity. Within 7 days, upgrade all instances running versions prior to 1.19.1 to version 1.19.1 or later, prioritizing production and shared development forges. Within 30 days, verify successful patch deployment across all systems, audit Markdown content created during the vulnerable period for malicious scripts, review access logs for exploitation indicators, and establish monitoring rules to detect future script injection attempts.

Apache Allura EUVD-2026-57344

| CVE-2026-73237 MEDIUM

Basic XSS (CWE-80)

2026-08-12 apache

GHSA-q6fp-vfv9-v477

XSS Apache Apache Allura Apache Software Foundation

6.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.1 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable XSS needing a low-privilege account to post Markdown (PR:L) and a victim viewing it (UI:R); scope changes to the victim's browser (S:C) with limited confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 12, 2026 - 18:17 EUVD

Analysis Generated

Aug 12, 2026 - 17:37 vuln.today

CVE Published

Aug 12, 2026 - 16:42 cve.org

CRITICAL

DescriptionCVE.org

XSS vulnerability in Markdown handling in Apache Allura.

This issue affects Apache Allura: from 1.10.0 before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

AnalysisAI

Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an attacker to inject script-related HTML into content that other users view, executing arbitrary JavaScript in their browsers. Because Allura is a collaborative forge where users routinely post Markdown in tickets, wiki pages, and comments, the payload is most likely stored and delivered to victims who open the affected page. No public exploit identified at time of analysis, and there is no CISA KEV listing or POC signal; the Apache PMC has released version 1.19.1 as the fix.

Technical ContextAI

Apache Allura is an open-source, Python-based project-hosting and collaboration platform - the software that powers SourceForge and Apache's own forge - providing wikis, ticket trackers, code repositories, forums, and blogs. Much of its user-generated content is authored in Markdown and converted to HTML server-side before display. The flaw is classified CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page, i.e. 'basic' XSS), meaning the Markdown-to-HTML pipeline fails to fully neutralize script-bearing tags or attributes, so crafted Markdown survives sanitization and reaches the DOM as executable markup. The single affected CPE, cpe:2.3:a:apache_software_foundation:apache_allura, confirms the vulnerable component is the Allura application itself rather than a bundled third-party library.

RemediationAI

Vendor-released patch: upgrade Apache Allura to version 1.19.1 or later, as recommended in the Apache advisory (https://allura.apache.org/posts/2026-allura-1.19.1.html and https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0). This is the primary and complete fix. If an immediate upgrade is not possible, reduce exposure by restricting who can post Markdown content - limit new or untrusted account registration and comment, wiki, and ticket creation to trusted users - which shrinks the pool of potential injectors but degrades the open-collaboration function of the forge. Additionally consider enforcing a strict Content-Security-Policy that disallows inline script execution, which blunts many XSS payloads but can break legitimate in-page scripts and must be tested against Allura's own UI before enforcement. These are stopgaps only; upgrading to 1.19.1 remains the correct remediation.