Quick answers
- Is CVE-2026-80190 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-80190 being exploited in the wild.
- How severe is CVE-2026-80190?
- Medium severity, with a CVSS score of 6.1, published 4 September 2026.
- Which products and versions are affected?
- Apache Allura through 1.20.0.
- Is there a fix for CVE-2026-80190?
- A patch was published on 2026-09-04: Fix available in version 1.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-80190 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-80190?
- Check whether you run Apache Allura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored XSS vulnerability in Apache Allura's SVN repository code viewer. The vulnerability occurs when processing SVN repository content, allowing an attacker to inject malicious JavaScript that persists and executes when other users view the affected code. Git repositories are not affected by this vulnerability. The attack requires network access to an Allura instance with SVN repositories, but likely does not require authentication to exploit. The vulnerability is partially mitigated by default Content Security Policy (CSP) headers, which restrict script execution. The fix is available in Apache Allura 1.21.0 and later.
Affected products
- Apache Allura through 1.20.0
Timeline
- 2026-09-03: disclosed
- 2026-09-04: patched: Fix available in version 1.21.0