CVE-2026-103863
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
51/100
Published: 2026-11-05
Modified: 2026-11-12
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
None
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Weakness Classification (2)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache Sling Engine | 0 < 3.0.4 |
| Apache Software Foundation | Apache Sling Engine | 0 < 3.0.4 |
| Apache Software Foundation | Apache Sling Engine | 0 < 3.0.4 |
References & Advisories (2)
vendor-advisory