Is CVE-2026-80180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80180 being exploited in the wild.

How severe is CVE-2026-80180?

Medium severity, with a CVSS score of 6.1, published 4 September 2026.

Is there a fix for CVE-2026-80180?

A patch was published on 2026-09-04: Version 1.21.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80180 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80180?

Check whether you run Apache Allura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80180: Apache Allura stored XSS via markdown HTML processing

CVE-2026-80180 · Severity: medium · CVSS 6.1 · Published 2026-09-04

Apache Allura is a web-based project management and collaboration platform used for open-source software development. A stored cross-site scripting (XSS) vulnerability in its markdown HTML processing allows authenticated or unauthenticated attackers to inject malicious scripts that execute in the browsers of other users who view the affected content, potentially leading to account compromise, credential theft, or malicious actions performed on behalf of victims.

Technologies: Apache Allura. Vendors: Apache.

Quick answers

Is CVE-2026-80180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80180 being exploited in the wild.
How severe is CVE-2026-80180?: Medium severity, with a CVSS score of 6.1, published 4 September 2026.
Which products and versions are affected?: Apache Allura through 1.20.0.
Is there a fix for CVE-2026-80180?: A patch was published on 2026-09-04: Version 1.21.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80180 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80180?: Check whether you run Apache Allura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in Apache Allura's markdown HTML processing engine. The vulnerability arises from improper sanitization of user-supplied markdown input, allowing attackers to inject arbitrary HTML and JavaScript code that persists in the application's database. When other users view content containing the malicious payload, the script executes in their browser context with the privileges of the authenticated user. The vulnerability affects all versions through 1.20.0; patched version 1.21.0 is available.

Affected products

Apache Allura through 1.20.0

Timeline

2026-09-03: disclosed
2026-09-04: patched: Version 1.21.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.