oss-sec mailing list archives

CVE-2026-80180: Apache Allura: Stored XSS via markdown HTML processing

From: Dave Brondsema <dave () brondsema net>
Date: Thu, 3 Sep 2026 13:33:15 -0400

Severity: critical

Affected versions:

- Apache Allura through 1.20.0

Description:

Stored XSS via markdown HTML processing in Apache Allura.

This issue affects Apache Allura: from through 1.20.0.

Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Credit:

n0mi1k (reporter)

References:

https://allura.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-80180

Current thread:

CVE-2026-80180: Apache Allura: Stored XSS via markdown HTML processing Dave Brondsema (Sep 03)