anonhaven

CVE-2026-73237

MEDIUM CVSS 3.1: 6.1 EPSS 0.43%
Updated Aug 17, 2026
Apache
Parameter Value
CVSS 6.1 (MEDIUM)
Affected Versions 1.10.0 — 1.19.1
Fixed In 1.19.1
Type CWE-80 (Improper Neutralization of Script-Related HTML Tags (XSS))
Vendor Apache
Public PoC No

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-80 Improper Neutralization of Script-Related HTML Tags (XSS)

Vulnerable Products 1

Configuration From (including) Up to (excluding)
Apache Allura
cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*
 1.10.0 1.19.1

References 3

https://allura.apache.org/posts/2026-allura-1.19.1.html
security@apache.org
https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0
security@apache.org
http://www.openwall.com/lists/oss-security/2026/08/12/16
af854a3a-2127-422b-91ae-364da2661108
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-54789

Apache

7.5

CVE-2026-59654

Apache

6.8

CVE-2026-68745

Apache Software Foundation

None

CVE-2026-66797

Apache Software Foundation

None

CVE-2026-66722

Apache Software Foundation

None