Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Sling Engine | < 3.0.4 | 3.0.4 |
Advisories 1
- WID-SEC-2026-4374 Apache Sling: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026