Is CVE-2026-82387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82387 being exploited in the wild.

How severe is CVE-2026-82387?

Medium severity, with a CVSS score of 5.4, published 28 September 2026.

Which products and versions are affected?

Apache Roller 6.1.5 and earlier.

Is there a fix for CVE-2026-82387?

A patch was published on 2026-09-05: Fix merged in PR #174; upgrade to 6.1.6 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82387 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82387?

Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82387: Apache Roller cross-site scripting in media upload

CVE-2026-82387 · Severity: medium · CVSS 5.4 · Published 2026-09-28

Apache Roller is a blogging platform used to publish web content. A user with permission to upload media files can upload a malicious file with a forged content type, causing browsers to execute embedded scripts when others view the file. This allows attackers to steal user data or sessions. Installations have media uploads disabled by default, so only those that enable the feature are at risk.

Technologies: Apache Roller. Vendors: Apache.

Quick answers

Is CVE-2026-82387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82387 being exploited in the wild.
How severe is CVE-2026-82387?: Medium severity, with a CVSS score of 5.4, published 28 September 2026.
Which products and versions are affected?: Apache Roller 6.1.5 and earlier.
Is there a fix for CVE-2026-82387?: A patch was published on 2026-09-05: Fix merged in PR #174; upgrade to 6.1.6 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82387 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82387?: Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is stored cross-site scripting (XSS) in the media upload feature. An authenticated user with media-upload rights can upload a file with active content (e.g., JavaScript or CSS) and declare a forged content type; the application stores and serves it back with the attacker-supplied type, causing browser execution. The fix derives content type from file content rather than the upload declaration and serves non-image media as downloads with nosniff headers, blocking inline execution.

Affected products

Apache Roller 6.1.5 and earlier

Timeline

2026-09-28: disclosed
2026-09-05: patched: Fix merged in PR #174; upgrade to 6.1.6 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.