Executive brief
Apache Allura is an open-source project hosting platform used to manage collaborative software development. A cross-site scripting (XSS) vulnerability in its Markdown handling allows attackers to inject malicious scripts that could be executed in other users' browsers, potentially leading to session hijacking, credential theft, or defacement of content.
Technical details
An XSS vulnerability exists in Apache Allura's Markdown processing component, affecting versions 1.10.0 through 1.19.0. The flaw permits injection of malicious JavaScript code through crafted Markdown input, which is then rendered without proper sanitization. Attack requires network access to submit Markdown content (such as in project comments, documentation, or issue descriptions) but does not require authentication. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' sessions. The vulnerability is fixed in version 1.19.1.
Affected products
- Apache Allura 1.10.0 to 1.19.0
Timeline
- 2026-06-29: disclosed: CVE-2026-73237 listed in Apache Allura 1.19.1 release announcement
- 2026-06-29: patched: Fixed in Apache Allura 1.19.1