Apache Apache Allura
15 CVEs affecting Apache Apache Allura. Latest disclosed: 2026-09-04. Critical: 3, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73240 | Critical | 9.8 | 2026-08-12 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to up… |
CVE-2026-80181 | Critical | 9.1 | 2026-09-04 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended t… |
CVE-2026-69223 | Critical | 9.1 | 2026-08-11 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgr… |
CVE-2026-81270 | High | 7.5 | 2026-09-04 | Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to versi… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2018-1299 | High | 7.5 | 2018-02-06 | In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, suc… |
CVE-2026-73239 | Medium | 6.5 | 2026-08-12 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: befor… |
CVE-2026-80190 | Medium | 6.1 | 2026-09-04 | Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP hea… |
CVE-2026-80180 | Medium | 6.1 | 2026-09-04 | Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to vers… |
CVE-2026-73238 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, whic… |
CVE-2026-73237 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to ver… |
CVE-2018-1319 | Medium | 6.1 | 2018-03-15 | In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results m… |
CVE-2026-75099 | Medium | 5.3 | 2026-08-24 | Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upg… |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2024-38379 | Medium | 4.8 | 2024-06-22 | Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limit… |