CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of files readable by the Roller process. The Trackback control is hidden in the standard UI, but its action remains directly reachable, and no non-default server configuration is required. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback response parser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Rollerto a version that resolves this vulnerability.Fixed in 6.1.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with entry-editing rights on a Roller weblog can exploit it. The attacker does not need access to a visible Trackback control because the underlying action remains directly reachable.
Are default deployments affected?
Yes. No non-default server configuration is required for exploitation, although the attacker must have entry-editing rights on a weblog.
What information could be exposed?
The issue can disclose files that are readable by the Apache Roller process. The provided information does not indicate that it permits modification of those files or service disruption.
What should teams do if they are running the affected release?
Upgrade to Apache Roller 6.1.6 or later. That release removes the outbound Trackback response parser involved in the issue.