7.7
High
CVE-2026-82386 Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files…
Description
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator bookmark-import action. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which uses a hardened parser that disables external entities and document type declarations.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Roller | 6.1.5 | No fix stated |
References
- github.com github.com
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Roller
The 24 CVEs of Apache Roller →
CVE-2026-86507
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted…
6.1
Medium
CVE-2026-82379
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest…
7.7
High
CVE-2026-82380
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform…
8.1
High
CVE-2026-82381
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
5.4
Medium