Apache Roller 6.1.7 fixes 15 security issues, including XXE
The Apache Roller PMC published 15 advisories on November 11, 2026, with fixes in release 6.1.7.
Stories per day · 30 days
5 RSS
4 stories, newest first · one card per story
Stories tagged #apache-roller
CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import
Apache Roller 6.1.5 lets weblog admins read local files via XXE in OPML imports.
CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
Apache Roller 6.1.5 has unauthenticated XML-RPC deserialization rated CVSS 9.8.
CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed
Apache Roller 6.1.5 lets attackers replay captured WSSE digest headers to bypass AtomPub authentication.