CVE-2026-82376

Apache Roller 6.1.5 has an XML external entity (XXE) flaw in its outbound trackback response parser. A user who already has entry-editing rights on a weblog can cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution. The trackback control is hidden in the standard UI, but the action remains directly reachable and no non-default server configuration is required. Successful exploitation can disclose files readable by the Roller process, with high confidentiality impact and no direct integrity or availability impact. No public proof-of-concept is known and the issue is not in the CISA KEV catalog.

What to do: Upgrade Apache Roller to 6.1.6 or later, which removes the outbound trackback response parser. Until then, limit weblog entry-editing rights to trusted users and treat the trackback action as reachable even though it is hidden in the standard UI. If unauthorized trackback activity is suspected, review logs and assume files readable by the Roller process may have been disclosed.