CVE-2026-80190: Apache Allura: Stored XSS via code repositories

[Dave Brondsema <dave () brondsema net>]

Severity: low

Affected versions:

- Apache Allura through 1.20.0

Description:

Apache Allura: stored XSS via SVN code repositories.  Git repositories are not 
known to be affected.  The vulnerability is likely mitigated via default CSP 
headers.

This issue affects Apache Allura: through 1.20.0.

Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Credit:

n0mi1k (reporter)

References:

https://allura.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-80190