Vulnerability · Published Nov 5, 2026 · Assigned by apache

CVE-2026-103863Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

Unrated

In plain English

A cross-site scripting in Apache Sling Engine from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS )–Not rated

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Sling Engine	0 – before 3.0.4

Weakness: CWE-79, CWE-693

In plain English

Official description

Affected products (as reported)

References