Vulnerabilitymedium
CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files
AI summary · grok-4.7Summaries by Vani AI
Apache Roller 6.1.5 lets admins escape the Velocity sandbox and read classpath secrets.
Apache disclosed CVE-2026-82385 in Apache Roller 6.1.5, scored CVSS 3.1 6.5. A weblog administrator can author a Velocity template that uses an include directive to load classpath resources, bypassing the Velocity sandbox. That can expose Roller configuration files on the classpath, including secrets. The advisory does not report active exploitation.
Key facts
- Affects Apache Roller 6.1.5
- Weblog admin can escape the Velocity sandbox
- Include directive reads application classpath files
- Configuration files containing secrets may be exposed
- CVSS 3.1 base score 6.5
- CVEs
- CVE-2026-82385
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82385 | Classpath secret disclosure via templates in Apache Roller | 6.5 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Important CVSS 3. 1: 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.