CVE-2026-73237CWE-80

CVE-2026-73237

Medium · published August 12, 2026

CVSS v3.1

6.1

EPSS

Percentile

55.7

In the wild

Unconfirmed

What it is

XSS vulnerability in Markdown handling in Apache Allura.

This issue affects Apache Allura: from 1.10.0 before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00794 · 55.7th percentile
Weakness: CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published: 2026-08-12T21:17Z

Affected products (1)

Product	Versions	Fixed in
apache/allura	≥ 1.10.0, < 1.19.1	1.19.1

References (3)

EPSS history

Timeline