Medium · 6.1 CVE-2026-73192 EUVD-2026-85173GHSA-84wv-6469-cpqp

Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Sling XSS

Description

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.

Upgrade to Apache Sling XSS >= 2.4.12

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Sling XSS	< 2.4.12	2.4.12

Advisories 1

WID-SEC-2026-3526 Apache Sling: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026

References

https://sling.apache.org/news.html vendor-advisory