Is CVE-2026-111824 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111824 being exploited in the wild.

How severe is CVE-2026-111824?

Informational severity, published 11 November 2026.

How is CVE-2026-111824 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111824?

Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111824: Apache Roller stored cross-site scripting in custom theme media

CVE-2026-111824 · Severity: info · Published 2026-11-11

Apache Roller is a blogging platform that allows users to create custom themes. An authenticated author with theme customization rights can upload files through the media library that execute malicious scripts in the browsers of visitors viewing the blog, potentially stealing credentials, session tokens, or personal data. This vulnerability was inadvertently introduced by a previous security fix and affects deployments that use custom themes with media uploads enabled.

Technologies: Apache Roller. Vendors: Apache.

Quick answers

Is CVE-2026-111824 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111824 being exploited in the wild.
How severe is CVE-2026-111824?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Apache Roller 6.1.6.
Is there a fix for CVE-2026-111824?: Yes: fixed in Apache Roller 6.1.7 or later. Until then: Disable media uploads by setting media uploads disabled by default configuration, or restrict the Author role to users who cannot access custom theme management until upgrading.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-11"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111824 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111824?: Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Roller 6.1.7 or later

Disable media uploads by setting media uploads disabled by default configuration, or restrict the Author role to users who cannot access custom theme management until upgrading.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-11"}]

Technical details

A stored cross-site scripting vulnerability exists in Apache Roller 6.1.6 where authenticated users with author role can craft media file paths during upload to control how the server delivers those files from custom theme resources. Unlike the standard media endpoint which restricts dangerous file types, custom theme media resources were served with content types derived from the file path, allowing an attacker to upload JavaScript or HTML files that execute when accessed via the theme's resource URL. The vulnerability requires authentication and media uploads to be enabled (disabled by default), but no further user interaction for exploitation.

Affected products

Apache Roller 6.1.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.