https://seclists.org/oss-sec/2026/q3/950: CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and ads classpath files
Published Sep 25, 2026
·Updated
Affected Software
1 affected component
Apache Roller=6.1.5
Frequently Asked Questions
1
Who can exploit this issue in a Roller deployment?
A weblog administrator who can author weblog templates can exploit it. The issue is relevant because Roller treats weblog administrators as untrusted, yet their templates can use unconstrained Velocity include or parse directives.
2
Are default installations affected?
Yes. No non-default configuration is required; any affected Apache Roller 6.1.5 weblog whose administrator can author templates is exposed.
3
What information could be exposed?
An attacker can read files on the application classpath outside the theme namespace. This can include Roller configuration files containing secrets.
4
How can the issue be remediated?
Upgrade Apache Roller to version 6.1.6 or later. The fix confines includes to the active theme and removes classpath resource loading during weblog rendering.