Is CVE-2026-91204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91204 being exploited in the wild.

How severe is CVE-2026-91204?

Medium severity, with a CVSS score of 6.1, published 28 September 2026.

Which products and versions are affected?

Apache Roller 6.1.5 and earlier.

Is there a fix for CVE-2026-91204?

A patch was published on 2026-09-17: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91204 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91204?

Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91204: Apache Roller cross-site scripting in HTML comments

CVE-2026-91204 · Severity: medium · CVSS 6.1 · Published 2026-09-28

Apache Roller is a web-based blogging and content management platform. An attacker can inject malicious JavaScript code hidden in comment links, which executes in the browser of users who click those links. This requires the site owner to enable HTML in comments and use the HTMLSubset formatter, and can lead to account takeover or credential theft.

Technologies: Apache Roller. Vendors: Apache.

Quick answers

Is CVE-2026-91204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91204 being exploited in the wild.
How severe is CVE-2026-91204?: Medium severity, with a CVSS score of 6.1, published 28 September 2026.
Which products and versions are affected?: Apache Roller 6.1.5 and earlier.
Is there a fix for CVE-2026-91204?: A patch was published on 2026-09-17: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91204 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91204?: Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting vulnerability exists in Apache Roller's HTMLSubset comment formatter when HTML comments are enabled. An unauthenticated attacker can submit comments containing javascript: URI scheme links that bypass sanitization, survive the HTML comment formatting process, and execute in visitors' browsers. The vulnerability is fixed in version 6.1.6 by restricting allowed URI schemes to http, https, and mailto.

Affected products

Apache Roller 6.1.5 and earlier

Timeline

2026-09-28: disclosed
2026-09-17: patched: Fix merged into master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.