CVE-2026-73237 is a persistent cross-site scripting vulnerability in Apache Allura's Markdown rendering pipeline, present from version 1.10.0 through 1.19.1. If you run Allura, treat this as higher priority than the CVSS 6.1 suggests—not because the technical severity is misrated, but because the asset classification is wrong.
A forge is not a comment section. Allura hosts code repositories, CI/CD credentials, release artifacts, and project metadata. When an XSS payload steals a session cookie from a user viewing a wiki page, the attacker gains access to that user's repository push permissions, possibly their CI tokens, and potentially the ability to inject malicious code into downstream supply chains. The path from 'reflected XSS on a wiki' to 'compromised release artifact' is direct and has been demonstrated in similar ecosystems. This is why the blast radius matters more than the CVSS base score.
The nine-version survival window—roughly two to three years of calendar exposure—is the most consequential detail. This is not a case where a single developer made a bad call in one sprint. The rendering pipeline accumulated complexity across multiple releases while audit attention likely decreased: the code worked, users built workflows around it, and nobody was actively touching the Markdown handler. That entropy is the real vulnerability. The fix at 1.19.1 addresses the immediate issue but does not automatically reset the architectural assumptions that allowed it to persist.
Your priority actions: upgrade to 1.19.1 or later immediately; audit any Allura instances you manage for extended version gaps (1.10.x through 1.18.x still in production); and implement a content security policy that treats all user-submitted Markdown as untrusted regardless of Allura version—effectively moving sanitization from a code dependency to a deployment configuration. The install base that never upgrades is where this vulnerability's real risk materializes, and CSP is the only control that reaches those forgotten deployments.