CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser
Apache Roller 6.1.5 parses trackback responses with XXE enabled, exposing server files.
Apache disclosed CVE-2026-82376, an XML external entity flaw in Apache Roller 6.1.5. A user with entry-editing rights can cause the server to parse an attacker-influenced trackback response with a parser that does not disable external entity resolution, leading to file disclosure. CVSS 3.1 is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), and the project rated it important. The advisory does not report exploitation in the wild.
- CVE-2026-82376 is an XXE flaw in Apache Roller 6.1.5.
- A weblog editor can influence a trackback response the server parses.
- External entity resolution is not disabled, enabling file disclosure.
- CVSS 3.1 is 7.7 with high confidentiality impact only.
- No active exploitation is stated.
- CVEs
- CVE-2026-82376
- Vendors
- Apache Software Foundation
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82376 | XXE file disclosure in Apache Roller trackback parser | 7.7 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Important CVSS 3. 1: 7.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.