# CVE-2026-73237: Apache Allura XSS vulnerability in Markdown handling

Source: https://junglewise.ai/threats/cve-2026-73237-apache-allura-xss-vulnerability-in-markdown-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73237 · Severity: medium · CVSS 6.1 · Published 2026-08-12

Apache Allura is an open-source project hosting platform used to manage collaborative software development. A cross-site scripting (XSS) vulnerability in its Markdown handling allows attackers to inject malicious scripts that could be executed in other users' browsers, potentially leading to session hijacking, credential theft, or defacement of content.

Technologies: [Apache Allura](https://junglewise.ai/threats/technologies/allura). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-73237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73237 being exploited in the wild.

**How severe is CVE-2026-73237?** Medium severity, with a CVSS score of 6.1, published 12 August 2026.

**Which products and versions are affected?** Apache Allura 1.10.0 to 1.19.0.

**Is there a fix for CVE-2026-73237?** A patch was published on 2026-06-29: Fixed in Apache Allura 1.19.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73237 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73237?** Check whether you run Apache Allura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An XSS vulnerability exists in Apache Allura's Markdown processing component, affecting versions 1.10.0 through 1.19.0. The flaw permits injection of malicious JavaScript code through crafted Markdown input, which is then rendered without proper sanitization. Attack requires network access to submit Markdown content (such as in project comments, documentation, or issue descriptions) but does not require authentication. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' sessions. The vulnerability is fixed in version 1.19.1.

## Affected products

- Apache Allura 1.10.0 to 1.19.0

## Timeline

- 2026-06-29: disclosed: CVE-2026-73237 listed in Apache Allura 1.19.1 release announcement
- 2026-06-29: patched: Fixed in Apache Allura 1.19.1

## References

- [https://allura.apache.org/posts/2026-allura-1.19.1.html](https://allura.apache.org/posts/2026-allura-1.19.1.html)
- [https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0](https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0)

## Related threats

- [Apache Allura OAuth 1 rebinding vulnerability](https://junglewise.ai/threats/cve-2026-118196-oauth-1-rebinding-vulnerability-in-apache-allura-this-issue)
- [Apache Allura OAuth1 request replay attack](https://junglewise.ai/threats/cve-2026-92120-oauth1-request-replay-attack-vulnerability-in-apache-allura-this)
- [Apache Allura REST API mass assignment vulnerability](https://junglewise.ai/threats/cve-2026-92119-rest-api-mass-assignment-vulnerability-in-apache-allura-this)
- [Apache Allura OAuth1 callback validation vulnerability](https://junglewise.ai/threats/cve-2026-92116-oauth1-callback-validation-vulnerability-in-apache-allura-this)
- [Apache Allura stored XSS in SVN repositories](https://junglewise.ai/threats/cve-2026-80190-apache-allura-stored-xss-in-svn-repositories)