Apache Roller (Product): news timeline & CVEs

CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Apache Roller 6.1.5 has a moderate reflected XSS in its optional LDAP comment authenticator.

Apache disclosed CVE-2026-91206, a reflected cross-site scripting flaw in Apache Roller 6.1.5. The optional LDAP comment authenticator writes request parameter values into its HTML form without proper neutralization. Apache rates it moderate, with CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation requires a victim to interact with a crafted link; no in-the-wild use is described.

oss-securitySep 25, 21:48 UTC · 1d agoVulnerability 17 sources CVE-2026-91206

CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments

Apache Roller 6.1.5 lets anonymous users store a javascript: URI that executes for comment visitors.

CVE-2026-91204 is a stored cross-site scripting issue in Apache Roller 6.1.5. An anonymous remote attacker can post a comment containing a javascript: URI that survives HTML comment formatting and can execute script in a visitor's browser. Apache scores it CVSS 3.1 6.1 (medium), with network access, no privileges, and required user interaction. The advisory does not report active exploitation.

oss-securitySep 25, 21:46 UTC · 1d agoVulnerability 17 sources CVE-2026-91204

CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL

Apache Roller 6.1.5 stored XSS can run in moderator or administrator sessions via comment-author URLs.

CVE-2026-86507 is a stored XSS flaw in Apache Roller 6.1.5 comment moderation. An anonymous attacker can store a crafted comment-author URL that executes script when a weblog moderator or global administrator views the comment management page. Apache calls the issue Important, though the published CVSS 3.1 vector is 6.1 (medium) and requires user interaction. It affects sites that allow the vulnerable comment behavior; exploitation is not reported as observed.

oss-securitySep 25, 21:45 UTC · 1d agoVulnerability 17 sources CVE-2026-86507

CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links

Apache Roller 6.1.5 has stored XSS via crafted Trackback author URLs, CVE-2026-82546.

Apache disclosed CVE-2026-82546, a stored cross-site scripting flaw in Apache Roller 6.1.5 rated moderate with CVSS 3.1 base score 6.1. An unauthenticated remote attacker can store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The issue requires user interaction and has low confidentiality and integrity impact with changed scope. No exploitation in the wild is described.

oss-securitySep 25, 21:43 UTC · 1d agoVulnerability 17 sources CVE-2026-82546

CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type

Apache Roller 6.1.5 allows media uploaders to store XSS by spoofing content type, CVE-2026-82387.

Apache disclosed CVE-2026-82387, a stored cross-site scripting flaw in Apache Roller 6.1.5 with a CVSS 3.1 score of 5.4. A user who already has media-upload rights can store active content on the Roller origin because uploads trust the supplied content type and that content is then served. Exploitation requires low privileges and user interaction, with low confidentiality and integrity impact. No in-the-wild exploitation is reported.

oss-securitySep 25, 21:41 UTC · 1d agoVulnerability 17 sources CVE-2026-82387

CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import

Apache Roller 6.1.5 lets weblog admins read local files via XXE in OPML imports.

Apache disclosed CVE-2026-82386, an XML external entity flaw in Apache Roller 6.1.5 rated Important with CVSS 3.1 7.7. A weblog administrator can import a crafted OPML document because the bookmark import parser does not disable external entities. The flaw can expose files readable by the Roller process and allow requests to internal network addresses. No exploitation in the wild is reported.

oss-securitySep 25, 21:39 UTC · 1d agoVulnerability 17 sources CVE-2026-82386

CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Apache Roller 6.1.5 lets admins escape the Velocity sandbox and read classpath secrets.

Apache disclosed CVE-2026-82385 in Apache Roller 6.1.5, scored CVSS 3.1 6.5. A weblog administrator can author a Velocity template that uses an include directive to load classpath resources, bypassing the Velocity sandbox. That can expose Roller configuration files on the classpath, including secrets. The advisory does not report active exploitation.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:37 UTC · 1d agoVulnerability 17 sources CVE-2026-82385

CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Apache Roller 6.1.5 has unauthenticated XML-RPC deserialization rated CVSS 9.8.

Apache disclosed CVE-2026-82384, a critical deserialization flaw in Apache Roller 6.1.5 with CVSS 3.1 9.8. The XML-RPC endpoint accepts vendor extension types that are deserialized while parsing a request, before authentication. An unauthenticated remote attacker can therefore cause deserialization of attacker-controlled bytes, with high impact on confidentiality, integrity, and availability. The advisory does not say the flaw is being exploited.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:35 UTC · 1d agoVulnerability 17 sources CVE-2026-82384

CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering

Apache Roller 6.1.5 lets unauthenticated attackers persistently change the site frontpage weblog selection.

Apache disclosed CVE-2026-82383 in Apache Roller 6.1.5, rated Important with CVSS 3.1 8.2. Missing authentication lets an unauthenticated remote attacker persistently change the site-global frontpage weblog selection because the setup action remains reachable after installation. Impact is high integrity and low availability, with no confidentiality loss. The advisory does not report exploitation in the wild.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:33 UTC · 1d agoVulnerability 17 sources CVE-2026-82383

CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter

Apache Roller 6.1.5 reflected XSS targets frontpage-theme visitors through a crafted directory parameter.

CVE-2026-82382 is a reflected cross-site scripting flaw in Apache Roller 6.1.5, scored CVSS 3.1 6.1 and rated Moderate. A remote attacker can supply a crafted blog-directory parameter to the bundled frontpage theme and run script in a weblog visitor's browser. The issue requires user interaction and has low confidentiality and integrity impact with changed scope. The post does not report active exploitation.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:31 UTC · 1d agoVulnerability 17 sources CVE-2026-82382

CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI

Apache Roller 6.1.5 stored XSS lets authors inject content that runs in the authoring UI.

CVE-2026-82381 is stored cross-site scripting in the Apache Roller 6.1.5 authoring UI. Apache rates it Important, while CVSS 3.1 is 5.4. A user with weblog authoring rights can store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without neutralization. The flaw needs an authenticated author and a victim who views that UI, and no active exploitation is reported.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:30 UTC · 1d agoVulnerability 17 sources CVE-2026-82381

CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation

Apache Roller 6.1.5 CSRF filters accept requests without the salt token, enabling forged state-changing actions.

Apache Roller 6.1.5 has a cross-site request forgery flaw, CVE-2026-82380, rated Important with a CVSS 3.1 score of 8.1. CSRF validation filters accept a request that does not submit the required salt token, so a remote attacker can cause a logged-in user to perform state-changing actions under that user's authority. The vector is network, low complexity, and no privileges, but it requires user interaction; confidentiality is unaffected while integrity and availability impacts are high. Only version 6.1.5 is listed as affected, and exploitation in the wild is not reported.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:28 UTC · 1d agoVulnerability 17 sources CVE-2026-82380

CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed

Apache Roller 6.1.5 lets attackers replay captured WSSE digest headers to bypass AtomPub authentication.

CVE-2026-82379 is a capture-replay authentication bypass in Apache Roller 6.1.5, rated Moderate with a CVSS 3.1 score of 7.7. An attacker who captures a valid WSSE digest authentication header can replay it and gain the victim's AtomPub authority. Authentication does not enforce nonce uniqueness or timestamp freshness. The attack is network-based with high complexity, requires no privileges or user interaction, and has high confidentiality and integrity impact with low availability impact.

oss-securitySep 25, 21:26 UTC · 1d agoVulnerability CVE-2026-82379

CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity

Apache Roller 6.1.5 OAuth lets attackers bind a known request token to any account, including an administrator.

CVE-2026-82378 is an incorrect-authorization flaw in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5. An unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer can bind that token to an arbitrary account, including an administrator. CVSS 3.1 is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), although the project labeled the issue Moderate. The attack has high complexity and changed scope, with high impacts on confidentiality, integrity, and availability; in-the-wild exploitation is not reported.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:24 UTC · 1d agoVulnerability 17 sources CVE-2026-82378

CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Apache Roller 6.1.5 lets authenticated users read, modify, or delete other weblogs via XML-RPC.

Apache disclosed CVE-2026-82377 in Apache Roller 6.1.5. Missing authorization in the legacy XML-RPC Blogger and MetaWeblog handlers lets an authenticated user read, modify, or delete content belonging to other weblogs. The handlers authenticate the caller but do not verify permission on the target weblog. CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), while the project labeled severity moderate. Exploitation in the wild is not reported.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:22 UTC · 1d agoVulnerability 17 sources CVE-2026-82377

CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser

Apache Roller 6.1.5 parses trackback responses with XXE enabled, exposing server files.

Apache disclosed CVE-2026-82376, an XML external entity flaw in Apache Roller 6.1.5. A user with entry-editing rights can cause the server to parse an attacker-influenced trackback response with a parser that does not disable external entity resolution, leading to file disclosure. CVSS 3.1 is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), and the project rated it important. The advisory does not report exploitation in the wild.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:21 UTC · 1d agoVulnerability 17 sources CVE-2026-82376

CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

Apache Roller 6.1.5 lets weblog editors trigger SSRF through trackback and enclosure URLs.

Apache disclosed CVE-2026-82375, a server-side request forgery issue in Apache Roller 6.1.5. An authenticated user with entry-editing rights can cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The project notes the Trackback control is hidden in the standard interface. CVSS 3.1 is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), rated moderate by the project, with no stated in-the-wild exploitation.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:19 UTC · 1d agoVulnerability 17 sources CVE-2026-82375

CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

Apache Roller 6.1.5 lets one weblog's authors tamper with another weblog's resources.

Apache disclosed CVE-2026-82348 in Apache Roller 6.1.5. An authorization bypass through a user-controlled key lets an authenticated user with authoring rights on one weblog read, modify, or delete resources belonging to another weblog via unscoped identifier lookups. The issue affects multi-user installations where users author separate weblogs. CVSS 3.1 is 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L), and the project rated it important. No exploitation in the wild is reported.

oss-securityupdated Sep 25, 21:48 UTC · 1d agofirst Sep 25, 21:17 UTC · 1d agoVulnerability 17 sources CVE-2026-82348

Apache Roller

Timeline18 articles

Related CVEsby mentions

Appears with