What is the CVSS score of EUVD-2026-88131?

EUVD-2026-88131 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache Roller are affected by EUVD-2026-88131?

Organizations running Apache Roller 6.1.5 for internal or external weblog services face a sensitive file disclosure risk in which any user holding weblog administrator rights can read arbitrary files…

How to fix or mitigate EUVD-2026-88131?

Within 24 hours, confirm whether Apache Roller 6.1.5 is deployed in your environment and inventory every account holding weblog administrator rights; reduce that population to the minimum necessary and remove template-authoring permissions from anyone who does not strictly require them. Because no vendor-released patch is identified for CVE-2026-82385 at time of analysis, verify the current release status directly with the Apache Roller project and subscribe to its security announcements so you are alerted the moment a fixed version ships. Within 7 days, review existing Velocity templates across all weblogs for use of the #include and #parse directives or any reference to resources outside the active theme namespace, and audit Roller and web server logs for anomalous template edits or classpath file reads; rotate every credential, API key, or token stored in Roller configuration files that a reader could reach, and apply least-privilege file permissions on the Roller host so the application process cannot read unrelated configuration. Within 30 days, upgrade Apache Roller to the first vendor-released version beyond 6.1.5 as soon as it is available and validate the fix in a staging environment before production rollout; if no fix has been released by then, escalate with the vendor, formally accept the residual risk in writing, and continue the privilege-reduction and template-monitoring controls as standing measures.

Apache Roller EUVD-2026-88131

| CVE-2026-82385 MEDIUM

Information Exposure (CWE-200)

2026-09-25

GHSA-f2jw-h484-m8xv

Apache Java Information Disclosure

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable template rendering (AV:N/AC:L); requires an untrusted-but-authenticated weblog admin (PR:L); reads config secrets so C:H, with no integrity/availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Sep 28, 2026 - 08:22 NVD

6.5 (MEDIUM)

Metadata Corrected

Sep 25, 2026 - 22:40 vuln.today

tag: Java added

Analysis Generated

Sep 25, 2026 - 22:18 vuln.today

CVE Published

Sep 25, 2026 - 21:37 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 5

News 13 New Apache Tomcat Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Apache Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 25, 2026 News Critical Sensitive File Disclosure in Apache Roller 6.1.5 - CVE-2026-82385 Sep 25, 2026

AnalysisAI

Sensitive file disclosure in Apache Roller 6.1.5 allows an authenticated weblog administrator (CVSS PR:L) to read arbitrary files on the application classpath - including Roller configuration files that may contain secrets - by authoring a Velocity template that uses the #include or #parse directive to load a resource outside the active theme namespace. Roller's Velocity sandbox does not confine these directives, no non-default configuration is required, and any weblog whose administrator can author templates is affected; no public exploit identified at time of analysis.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated account holding the weblog administrator role with template-authoring capability on the target Roller weblog (PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, authenticated (PR:L) confidentiality-only disclosure with no integrity or availability impact and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Apache Roller 6.1.6 or later, which confines includes to the active theme and removes classpath resource loading from weblog rendering (Vendor-released patch: 6.1.6). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm whether Apache Roller 6.1.5 is deployed in your environment and inventory every account holding weblog administrator rights; reduce that population to the minimum necessary and remove template-authoring permissions from anyone who does not strictly require them. …

Threat intelligence, references, and detailed analysis are available after sign-in.