Description

Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-04T07:17:10.120Z",
  "pubdate": "2026-09-04T07:17:10.120Z",
  "executiveSummary": "Apache Allura is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability stemming from improper sanitization of HTML content processed via markdown. This security flaw enables a remote attacker to inject and execute arbitrary malicious scripts within the context of a victim's browser session.\nThe vulnerability exists because the application fails to adequately filter or encode HTML tags when rendering markdown-formatted content. Successful exploitation allows an attacker to execute unauthorized JavaScript, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, credential theft, or defacement of the application interface.\nThe impact is significant, as stored XSS can be weaponized to target any user accessing the affected page, including administrators, without requiring prior interaction beyond viewing the malicious content. The vulnerability affects Apache Allura versions up to 1.20.0.\nThe risk implication is high, necessitating immediate attention, particularly in multi-user environments where trust between content creators and viewers is not absolute. Attackers require no specialized authentication beyond the capability to contribute content that the application processes through its markdown renderer.",
  "technicalDetails": "The vulnerability is a Stored Cross-Site Scripting (XSS) flaw located within the markdown processing component of Apache Allura. The root cause lies in the insufficient sanitization or improper validation of user-supplied HTML input that is processed alongside markdown syntax.\nWhen the application renders markdown, it fails to properly neutralize dangerous HTML tags and attributes. An attacker can craft a payload containing malicious JavaScript—such as an <img> tag with an onerror event handler or a <script> tag—and store this within the system through any input field that supports markdown formatting, such as project descriptions, forum posts, or ticket comments.\nThe exploitation flow proceeds as follows: First, the attacker identifies an input vector that is processed by the markdown parser and subsequently rendered in the application's user interface. Second, the attacker crafts a malicious payload, for example: <img src=x onerror=alert('XSS')>. Third, the attacker submits this payload, which the server stores in the database without effective sanitization. Finally, when a victim accesses the affected page, the application serves the stored, malicious HTML to the user's browser. The victim's browser parses the injected content and executes the attacker's script in the security context of the vulnerable application.\nThis vulnerability allows an attacker to bypass standard web security controls, as the malicious code originates from the trusted domain of the Apache Allura instance. Once the JavaScript executes, the attacker can perform a wide range of actions, including stealing session cookies via document.cookie to facilitate account takeover, performing unauthorized state-changing operations on behalf of the authenticated user, or exfiltrating sensitive data visible on the page.\nThe vulnerability affects Apache Allura versions up to 1.20.0 inclusive. Exploitation does not require high-level privileges; any user capable of injecting markdown content can successfully trigger this vulnerability. The attack is persistent, meaning the malicious payload remains active until it is removed from the database or the underlying vulnerability is remediated through a patch.\nThis issue persists due to a mismatch between the expected markdown processing logic and the actual output rendered in the DOM, failing to adhere to secure coding practices regarding input sanitization for web-based content management systems."
}