CVE-2026-82385

Apache Roller 6.1.5 lets a weblog administrator read files on the application classpath, including Roller configuration files that contain secrets. The administrator authors a Velocity template whose include (or parse) directive loads a classpath resource outside the theme namespace. Roller treats weblog administrators as untrusted and enables a Velocity sandbox, but those directives are not confined by the sandbox, and no non-default configuration is required. Any Roller 6.1.5 weblog where an administrator can author templates is affected; confidentiality of classpath secrets is the impact, with no integrity or availability effect. There is no known public proof of concept and no listing in CISA KEV.

What to do: Upgrade Apache Roller to 6.1.6 or later, which confines template includes to the active theme and removes classpath resource loading from weblog rendering. Until then, treat any weblog administrator who can author templates as able to read classpath files, including configuration secrets. After upgrading, rotate credentials and other secrets that were stored in Roller configuration on the classpath, and review existing templates for include or parse directives that load resources outside the theme.