CVE-2026-82386

Apache Roller 6.1.5 has an XML external entity (XXE) flaw in its OPML bookmark-import parser, which does not disable external entity resolution or require any non-default configuration. A weblog administrator can trigger it by importing a crafted OPML document through the administrator bookmark-import action. Successful use lets that user read files accessible to the Roller process and reach internal network addresses (SSRF-style access); there is no integrity or availability impact in the published scoring. Only deployments running the affected Roller release with weblog-administrator access are in scope. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Apache Roller to 6.1.6 or later, which hardens the OPML bookmark-import parser by disabling external entities and document type declarations. Until then, limit weblog-administrator accounts and treat bookmark-import uploads as untrusted. After upgrading, review logs and the host for unexpected file reads or outbound requests from the Roller process.