Apache discloses six flaws in Roller 6.1.5
First coverage.
Apache disclosed six Roller 6.1.5 flaws on 25 September 2026: one XXE and five XSS issues, with no exploitation reported.
On 25 September 2026 Apache disclosed six vulnerabilities affecting Apache Roller 6.1.5. CVE-2026-82386 is an Important XML external entity flaw (CVSS 3.1 7.7) that lets a weblog administrator import a crafted OPML bookmark file, potentially exposing files readable by the Roller process and reaching internal network addresses. Five cross-site scripting issues were also published: stored XSS through media uploads that trust a client-supplied content type (CVE-2026-82387, CVSS 3.1 5.4); stored XSS via Trackback author URLs (CVE-2026-82546, CVSS 3.1 6.1); stored XSS in comment moderation via comment-author URLs (CVE-2026-86507); stored javascript: URIs in HTML comments (CVE-2026-91204, CVSS 3.1 6.1); and reflected XSS in the optional LDAP comment authenticator (CVE-2026-91206, CVSS 3.1 6.1). Sources disagree on CVE-2026-86507 severity: Apache calls it Important while the published CVSS 3.1 score is 6.1 (medium). None of the advisories report exploitation in the wild, and only version 6.1.5 is listed as affected.
- On 2026-09-25 Apache disclosed six issues, all listing only Apache Roller 6.1.5 as affected, with no in-the-wild exploitation reported.
- CVE-2026-82386 is an Important XXE flaw in OPML bookmark import, CVSS 3.1 7.7; a weblog administrator can read files readable by the Roller process and reach internal addresses.
- CVE-2026-82387 is stored XSS via media uploads that trust a client-supplied content type, CVSS 3.1 5.4; it needs media-upload rights and user interaction.
- CVE-2026-82546 is stored XSS through Trackback author URLs, CVSS 3.1 6.1 (moderate); an unauthenticated attacker needs a published entry that accepts comments and Trackbacks, plus user interaction.
- CVE-2026-86507 is stored XSS in comment moderation via a comment-author URL that can run in a weblog moderator or global administrator session; Apache labels it Important while the published CVSS 3.1 score is 6.1.
- CVE-2026-91204 lets an anonymous user store a javascript: URI in an HTML comment that can execute for visitors, CVSS 3.1 6.1, with user interaction required.
- CVE-2026-91206 is reflected XSS in the optional LDAP comment authenticator, CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), requiring a victim to follow a crafted link.
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Coverage
oldest first · one row per article · UTC- · Sep 25, 2026
oss-securityFirst report
CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import
Apache Roller 6.1.5 lets weblog admins read local files via XXE in OPML imports.
- · Sep 25, 2026
CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type
Apache Roller 6.1.5 allows media uploaders to store XSS by spoofing content type, CVE-2026-82387.
- · Sep 25, 2026
CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links
Apache Roller 6.1.5 has stored XSS via crafted Trackback author URLs, CVE-2026-82546.
- · Sep 25, 2026
CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL
Apache Roller 6.1.5 stored XSS can run in moderator or administrator sessions via comment-author URLs.
- · Sep 25, 2026
CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments
Apache Roller 6.1.5 lets anonymous users store a javascript: URI that executes for comment visitors.
- · Sep 25, 2026
CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator
Apache Roller 6.1.5 has a moderate reflected XSS in its optional LDAP comment authenticator.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82386+4 related CVEs | XXE in Apache Roller OPML bookmark import | 7.7 group max | — | ||
| CVE-2026-91206 | Reflected XSS in Apache Roller LDAP comment authenticator | 6.1 | — |