What is the CVSS score of EUVD-2026-88127?

EUVD-2026-88127 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache Roller are affected by EUVD-2026-88127?

Apache Roller 6.1.5, the open-source weblog platform behind many public-facing corporate, departmental and community blogs, contains a stored cross-site scripting flaw that allows any unauthenticated…

How to fix or mitigate EUVD-2026-88127?

Within 24 hours, inventory every Apache Roller 6.1.5 instance, prioritising internet-facing blogs, and confirm whether the incoming Trackback endpoint is reachable; where it is, disable or block that endpoint and review recently approved Trackback comments for non-HTTP(S) comment-author URLs, removing or sanitising any that resolve to script-bearing schemes before they are clicked. Within 7 days, upgrade all instances from 6.1.5 to Apache Roller 6.1.6 - the vendor-released patch version, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links - and validate after the upgrade that no Trackback entry point remains and that comment-author links render only for HTTP(S) destinations; for client-facing deployments, add a web application firewall rule or Content Security Policy restricting inline script and non-HTTP(S) link schemes in comment rendering in the interim. Within 30 days, re-scan for any remaining 6.1.5 hosts, rotate credentials and invalidate active sessions for weblog authors and administrators as a precaution against session theft via the weblog origin, and add Trackback configuration and comment-link rendering to routine regression checks so that this attack path is re-verified at each future Roller upgrade.

Apache Roller EUVD-2026-88127

| CVE-2026-82546 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-25

GHSA-mw5j-2pgh-fm6m

XSS Apache Java

6.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network storage (PR:N/AV:N) but execution needs a victim click (UI:R); script in weblog origin crosses scope (S:C) with limited browser-side C:L/I:L, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Sep 28, 2026 - 08:22 NVD

6.1 (MEDIUM)

Metadata Corrected

Sep 25, 2026 - 22:40 vuln.today

tag: Java added

Analysis Generated

Sep 25, 2026 - 22:17 vuln.today

CVE Published

Sep 25, 2026 - 21:43 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 13 New Apache Tomcat Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Apache Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 25, 2026

AnalysisAI

Stored cross-site scripting in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persist a crafted comment-author URL through the incoming Trackback endpoint, which the shipped Trackback verification and moderation defaults approve and render as an active link; a visitor who clicks that link executes attacker-controlled script in the weblog's origin. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attack requires no authentication but does require user interaction, since the payload only fires on click rather than automatically on page load, so it is not a self-executing compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the target Roller 6.1.5 instance to have a PUBLISHED entry that accepts both comments AND incoming Trackbacks - this is the exposed surface. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but modest-priority stored XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links, addressing both the injection vector and the rendering sink; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every Apache Roller 6.1.5 instance, prioritising internet-facing blogs, and confirm whether the incoming Trackback endpoint is reachable; where it is, disable or block that endpoint and review recently approved Trackback comments for non-HTTP(S) comment-author URLs, removing or sanitising any that resolve to script-bearing schemes before they are clicked. …

Threat intelligence, references, and detailed analysis are available after sign-in.