CVE-2026-103863

org.apache.sling/org.apache.sling.engine: Apache Sling Engine: Stored Cross-Site Scripting via header protection bypass

org.apache.sling/org.apache.sling.engine

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4…

5. Nov 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• NVD
  CVE-2026-103863