As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
Apache Sling Engine before version 3.0.4 contains a cross-site scripting (XSS) vulnerability where an included component can bypass include-protection mitigations by modifying Content-Type, charset, and redirect headers through setHeader() and repeated setContentType() calls. The vulnerability allows attackers to evade protectheaders and checkcontenttype enforcement mechanisms.
Why it matters: Organizations running Apache Sling Engine before 3.0.4 should upgrade immediately to patch this XSS vulnerability that permits attackers to inject malicious scripts by circumventing existing security controls.
- Source published
- First seen by Cybersecurity Tracker