Vulnerabilityhigh
CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import
AI summary · grok-4.7Summaries by Vani AI
Apache Roller 6.1.5 lets weblog admins read local files via XXE in OPML imports.
Apache disclosed CVE-2026-82386, an XML external entity flaw in Apache Roller 6.1.5 rated Important with CVSS 3.1 7.7. A weblog administrator can import a crafted OPML document because the bookmark import parser does not disable external entities. The flaw can expose files readable by the Roller process and allow requests to internal network addresses. No exploitation in the wild is reported.
Key facts
- Affects Apache Roller 6.1.5
- Weblog administrator can import a crafted OPML file
- Parser does not disable XML external entities
- Can read process-readable files and reach internal addresses
- CVSS 3.1 base score 7.7
- CVEs
- CVE-2026-82386
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82386 | XXE in Apache Roller OPML bookmark import | 7.7 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Important CVSS 3. 1: 7.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.