Open Source Security Mailing List

Discussion of security flaws, concepts, and practices in the Open Source community

List Archives

Latest Posts

Re: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX Simon McVittie (Sep 26)
Was this library advertised as being safe for use in setuid, setgid or
otherwise privileged processes? Looking at its description in my package
manager ("provides developers of file-sharing networks, file managers,
and WWW-indexing bots with a universal library to obtain meta-data about
files") I don't immediately see why it would be appropriate for a setuid
program to use this.

I think it's going to scale incredibly...

CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction Collin Funk (Sep 25)
On 2026-09-14, Brian Mak privately reported a security issue with a
function defined in libinetutils, a part of GNU Inetutils. The function
is used by rlogin, rlogind, and telnetd. The possible exploits using the
bug aren't entirely clear. Brian noticed the bug from 'telnetd'
crashing, which could lead to a denial of service. However, from our
discussions, we were also concerned about the possibility of code
execution on platforms...

CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX Haitam Lazaar (Sep 25)
Hello oss-security,

An untrusted search path vulnerability leading to Local Privilege
Escalation (LPE) was identified in GNU libextractor for versions prior
to 1.16. The vulnerability has been assigned CVE-2026-100310.

Description:
GNU libextractor before 1.16 uses getenv("LIBEXTRACTOR_PREFIX") in
`src/main/extractor_plugpath.c` (`get_installation_paths()`) to
determine plugin search paths without checking whether the calling
process...

CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator David M. Johnson (Sep 25)
Severity: Moderate
CVSS 3.1: 6.1 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a
remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes
request parameter values into its HTML form without...

CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments David M. Johnson (Sep 25)
Severity: Moderate
CVSS 3.1: 6.1 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an
anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting
and can execute script in the browser of a visitor...

CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL David M. Johnson (Sep 25)
Severity: Important
CVSS 3.1: 6.1 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted
comment-author URL that can execute script in the session of a weblog moderator or global administrator when the
comment management page is viewed. This affects sites that permit...

CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links David M. Johnson (Sep 25)
Severity: Moderate
CVSS 3.1: 6.1 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an
unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a
published entry accepts comments and Trackbacks. The...

CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type David M. Johnson (Sep 25)
Severity: Moderate
CVSS 3.1: 5.4 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a
user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the
upload-supplied content type and serves the...

CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import David M. Johnson (Sep 25)
Severity: Important
CVSS 3.1: 7.7 (high) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read
files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because
the bookmark import parser does not disable external entity...

CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files David M. Johnson (Sep 25)
Severity: Important
CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read
files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity
template that uses an include directive to load a classpath...

CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint David M. Johnson (Sep 25)
Severity: Critical
CVSS 3.1: 9.8 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions:

- Apache Roller 6.1.5

Description:

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause
deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are
deserialized during request parsing, before authentication. The servlet...

CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering David M. Johnson (Sep 25)
Severity: Important
CVSS 3.1: 8.2 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Affected versions:

- Apache Roller 6.1.5

Description:

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to
persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance,
because the setup action remains anonymously reachable after...

CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter David M. Johnson (Sep 25)
Severity: Moderate
CVSS 3.1: 6.1 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a
remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage
theme, by supplying a crafted blog-directory parameter...

CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI David M. Johnson (Sep 25)
Severity: Important
CVSS 3.1: 5.4 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions:

- Apache Roller 6.1.5

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a
user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's
JavaScript string literals and markup sinks without...

CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation David M. Johnson (Sep 25)
Severity: Important
CVSS 3.1: 8.1 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected versions:

- Apache Roller 6.1.5

Description:

Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform
state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not
submit the required salt token, validating instead...

More Lists

Dozens of other network security lists are archived at SecLists.Org.