CVE-2026-80190
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Apache Allura through version 1.20.0 is vulnerable to stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.
Risk Assessment
An attacker can inject a persistent script into content viewed by other users, potentially leading to data theft or session hijacking, though CSP may limit the impact.
Recommendation
Upgrade Apache Allura to version 1.21.0, which fixes the issue.
Other vulnerabilities in Apache Allura
See all- CVE-2026-80181Critical
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). The issue affects versions through 1.20.0 and is fixed in version 1.21.0.
- CVE-2026-73240Critical
Specifically crafted inputs may lead to git argument injection in Apache Allura before version 1.19.1.
- CVE-2026-69223Critical
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects versions before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.
- CVE-2026-81270High
Apache Allura through version 1.20.0 has a vulnerability that exposes non-public information via search. The issue is fixed in version 1.21.0.
- CVE-2026-80180Medium
Apache Allura through version 1.20.0 has a stored XSS vulnerability via markdown HTML processing. The issue is fixed in version 1.21.0.
- CVE-2026-75099Medium
Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura through 1.19.1.
- CVE-2026-73239Medium
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura before version 1.19.1.
- CVE-2026-73238Medium
XSS vulnerability in code display in Apache Allura before version 1.19.1.
- CVE-2026-73237Medium
XSS vulnerability in Markdown handling in Apache Allura from version 1.10.0 before 1.19.1.
Original NVD description (English source)
Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.