Apache Allura patched critical flaws
Apache Allura, a tool teams use to run their own private code-hosting site, had four security bugs. Attackers could hide working code inside normal-looking text to hijack other users' logins, trick the server into contacting internal systems, or read information that was supposed to stay private.
- Report priority
- High
- Victim
- Apache Allura
What is known
Allura did not properly filter certain user-submitted content: markdown text and SVN repository content could carry hidden script that runs in other users' browsers, the webhook feature could be pointed at attacker-chosen internal addresses, and the search feature could return results a user was not supposed to see.
What to do
Check the version number shown in your Allura installation's admin or about page. Any deployment on older versions are exposed to the cross-site scripting and server-side request forgery and search-exposure bugs, though the SVN-specific scripting bug does not affect forges that only use Git.
Upgrade to Apache Allura 1.21.0 from the project's official download page as soon as possible. Apache also notes that default Content-Security-Policy headers already reduce the impact of the SVN-specific scripting bug.
Reported details
The advisory covers four CVEs. CVE-2026-80180 is stored XSS in Allura's markdown-to-HTML rendering. CVE-2026-80181 is SSRF through the webhook feature, letting the server be forced to request internal-only addresses. CVE-2026-81270 lets the search function expose non-public data. CVE-2026-80190 is a second stored XSS limited to SVN-backed repositories, not Git, and is partly mitigated by default CSP headers.
All affect Allura through the latest version and are fixed in 1.21.0. No in-the-wild exploitation or public proof-of-concept is currently known.