Apache Roller EUVD-2026-88128

Exploitation requires that the Roller media-upload feature is ENABLED - it is disabled by default, so default installations of Apache Roller 6.1.5 are NOT affected. The attacker must hold an authenticated account with media-upload rights (PR:L), and a victim must actively open the uploaded file (UI:R) for the stored script to execute. The shipped content-type restrictions do not block active content once uploads are enabled, because Roller trusts the upload-supplied content type and serves the file back with it. These conditions - non-default configuration, upload privileges, and required victim interaction - substantially limit realistic exploitation despite the network attack vector.

This is a genuine but low-priority issue. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4 medium) tells a consistent story: network-reachable, low complexity, but requiring an authenticated account with media-upload rights (PR:L) AND victim interaction (UI:R - a victim must open the uploaded file). The scope change (S:C) reflects that the injected script executes in Roller's origin, potentially affecting other users' sessions, but confidentiality and integrity impact are only Low and availability is None, so this is not a code-execution or takeover primitive. There is NO EPSS score, NO CISA KEV listing, and NO public POC referenced in the provided data, so this is no public exploit identified at time of analysis. The severity rating from the vendor is 'Moderate,' which aligns with the medium CVSS. There is no conflict between the CVSS vector and the description - both indicate an authenticated, interaction-gated stored XSS. The most important real-world limiter is not captured in the CVSS score at all: media uploads are DISABLED BY DEFAULT, so only installations that explicitly enabled the feature are exposed, sharply narrowing the affected population beyond what the network vector suggests.

On a Roller install where media uploads have been enabled, an attacker holding an account with media-upload rights uploads a file whose content contains active script but which is submitted with an attacker-chosen content type (e.g., an HTML/SVG payload served back with a scriptable type). When another user - for example a blog editor or admin browsing the media library or a shared link - opens that uploaded file, the stored script executes in Roller's origin. No public exploit code is referenced in the available data.