cve-2026-103863

fkie_nvd
Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-79 CWE-693
NVD metadata
NVD status
Received
Source identifier
security@apache.org
References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."
    }
  ],
  "id": "CVE-2026-103863",
  "lastModified": "2026-11-05T13:17:06.880",
  "metrics": {},
  "published": "2026-11-05T13:17:06.880",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ],
      "source": "security@apache.org",
      "type": "Primary"
    }
  ]
}
View JSON API Download JSON