EUVD-2026-88136
GHSA-fp83-p2jc-p38w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Authenticated editor (PR:L), network/low-complexity, scope change reaching internal hosts (S:C); confidentiality limited to reflected metadata (C:L), minor integrity from triggering internal requests (I:L), no availability impact (A:N).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.
Articles & Coverage 2
AnalysisAI
Server-side request forgery in Apache Roller 6.1.5 allows an authenticated user holding entry-editing rights on a weblog to force the server to issue outbound HTTP requests to attacker-chosen destinations via the legacy outbound Trackback action and entry enclosure handling. No non-default configuration is required because the default Trackback allow-list is empty and therefore permits every destination, and although the Trackback control is hidden in the standard UI its Struts2 action remains directly reachable; requests can be aimed at loopback and private-network addresses, while the enclosure path additionally exposes response status, content type and length. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with entry-editing (author/editor) rights on a Roller weblog; PR:N does not apply. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority SSRF (CWE-918) in Apache Roller 6.1.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Apache Roller 6.1.6, which per the vendor advisory removes the outbound Trackback action and stops dereferencing enclosure URLs; the advisory is at https://lists.apache.org/thread/0p7kc0rjcpj3rf00cp96zfkfrz0ns4ny and the upstream changes are in https://github.com/apache/roller/pull/163 and https://github.com/apache/roller/pull/175. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Roller deployments, confirm which are running 6.1.5 or earlier, and temporarily restrict entry-editing rights to only trusted users; where operationally feasible, block or disable the legacy Trackback Struts2 action and entry enclosure endpoints at the web tier, and review server egress logs for outbound requests to loopback or private IP ranges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Roller
View allCross-weblog authorization bypass in Apache Roller 6.1.5 lets an authenticated user holding authoring rights on one webl
XML external entity (XXE) injection in Apache Roller 6.1.5 lets an authenticated user who holds entry-editing rights on
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today