CVE-2026-73237

MediumCVSS 6.1

Published: 12/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

XSS vulnerability in Markdown handling in Apache Allura from version 1.10.0 before 1.19.1.

Risk Assessment

An attacker could inject malicious script via Markdown content, potentially leading to session theft or other attacks on users.

Recommendation

It is recommended to upgrade Apache Allura to version 1.19.1, which fixes the issue.

Other vulnerabilities in Apache Allura

See all

CVE-2026-80181Critical
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). The issue affects versions through 1.20.0 and is fixed in version 1.21.0.
CVE-2026-73240Critical
Specifically crafted inputs may lead to git argument injection in Apache Allura before version 1.19.1.
CVE-2026-69223Critical
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects versions before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.
CVE-2026-92120Low risk· EPSS 4%
OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.
CVE-2026-92119Low risk· EPSS 20%
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CVE-2026-92116Low risk· EPSS 4%
OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CVE-2026-80190Medium
Apache Allura through version 1.20.0 is vulnerable to stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.
CVE-2026-81270High
Apache Allura through version 1.20.0 has a vulnerability that exposes non-public information via search. The issue is fixed in version 1.21.0.
CVE-2026-80180Medium
Apache Allura through version 1.20.0 has a stored XSS vulnerability via markdown HTML processing. The issue is fixed in version 1.21.0.
CVE-2026-75099Medium
Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura through 1.19.1.

Original NVD description (English source)

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS