CVE-2019-10085

The CVE-2019-10085 entry concerns Apache Allura versions prior to 1.11.0 with a stored XSS vulnerability in the user dropdown selector on the ticket creation/editing page. The issue arises from the vulnerability existing on that UI element, enabling malicious input to be stored and potentially ex...

CVE-2018-1299

In Apache Allura, CVE-2018-1299 affects Allura versions prior to 1.8.0. Unauthenticated attackers can retrieve arbitrary files via the Allura web application; some web servers (e.g., Nginx, Apache/mod_wsgi, paster) may mitigate, while others (e.g., gunicorn) do not. Mitigation is to upgrade to Al...

CVE-2026-73240

Apache Allura versions prior to 1.19.1 are vulnerable to git argument injection . This flaw occurs when specifically crafted inputs allow an attacker to insert unauthorized arguments into a git command executed by the application. The impact is severe, with a CVSS score of 9.8 , indicating high c...

CVE-2026-69223

Apache Allura versions prior to 1.19.1 are vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) flaw within its webhooks functionality. An attacker can exploit this vulnerability to induce the server-side application to make arbitrary requests to unintended locations, such as internal net...

CVE-2026-73238

A Cross-Site Scripting (XSS) vulnerability exists in the code display feature of Apache Allura . This flaw affects versions before 1.19.1 . The vulnerability allows for the improper neutralization of script-related HTML tags, potentially leading to script execution in the user's browser. To remed...

CVE-2026-73239

Apache Allura versions prior to 1.19.1 are vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is missing permission checks for multiple Artifact types , allowing unauthorized access to objects based on user-supplied input without sufficient authorization verification. To re...

CVE-2026-75099

Apache Allura versions through 1.19.1 are vulnerable to an unauthenticated REST disclosure of certain content items. This vulnerability allows an unauthorized actor to access sensitive information via the REST interface. Users are recommended to upgrade to version 1.20.0 , which contains the fix ...