CVE-2026-103863

The Apache Sling Engine (versions before 3.0.4 ) is vulnerable to a cross-site scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the protectheaders and checkcontenttype mitigations can be bypassed via uncovered response-wrapper paths. This bypa...