CVE-2026-82375

Apache Roller 6.1.5 has a server-side request forgery flaw in legacy outbound Trackback handling and entry enclosure URL processing. An authenticated user who can edit weblog entries can trigger outbound HTTP requests to attacker-chosen destinations; the Trackback action remains reachable even though its control is hidden in the standard UI, and the default empty Trackback allow-list permits all destinations, including loopback and private-network addresses. Enclosure handling is relevant only when an author supplies an enclosure URL and reveals the response status, content type, and length. No non-default server configuration is required. The issue is not listed in CISA KEV and no public proof-of-concept is known; users should upgrade to 6.1.6 or later.

What to do: Upgrade Apache Roller to 6.1.6 or later, which removes the outbound Trackback action and stops dereferencing enclosure URLs. Until then, restrict entry-editing rights, block outbound requests from the Roller host to loopback and private networks, and review weblog entries for unexpected Trackback or enclosure URLs.