CVE-2026-82546

Apache Roller 6.1.5 has a stored cross-site scripting flaw in how incoming Trackback comment-author URLs are handled. An unauthenticated remote attacker can submit a crafted author URL through the Trackback endpoint on a published entry that accepts comments and Trackbacks; shipped verification and moderation defaults can approve that value and render it as an active link. A visitor who clicks the link runs script in the weblog's origin, which can expose data or act as that visitor on the site. Sites running Apache Roller 6.1.5 with incoming Trackbacks enabled are affected. No public proof of concept is known, and the issue is not listed as exploited in the wild.

What to do: Upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links. If you cannot upgrade immediately, disable Trackbacks and delete any untrusted Trackback comments already stored.