Executive brief
Apache Allura is a project management and code collaboration platform that hosts multiple types of code repositories, including SVN and Git. A stored cross-site scripting (XSS) vulnerability in SVN repository handling allows attackers to inject malicious scripts that execute in other users' browsers when viewing repository content. The vulnerability is partially mitigated by default Content Security Policy headers, but users should upgrade to address the issue.
Technical details
This is a stored XSS vulnerability in Apache Allura's SVN repository code viewer. The vulnerability occurs when processing SVN repository content, allowing an attacker to inject malicious JavaScript that persists and executes when other users view the affected code. Git repositories are not affected by this vulnerability. The attack requires network access to an Allura instance with SVN repositories, but likely does not require authentication to exploit. The vulnerability is partially mitigated by default Content Security Policy (CSP) headers, which restrict script execution. The fix is available in Apache Allura 1.21.0 and later.
Affected products
- Apache Allura through 1.20.0
Timeline
- 2026-09-03: disclosed
- 2026-09-04: patched: Fix available in version 1.21.0