Apache Roller
Monthly
Server-side request forgery in Apache Roller 6.1.5 allows an authenticated user holding entry-editing rights on a weblog to force the server to issue outbound HTTP requests to attacker-chosen destinations via the legacy outbound Trackback action and entry enclosure handling. No non-default configuration is required because the default Trackback allow-list is empty and therefore permits every destination, and although the Trackback control is hidden in the standard UI its Struts2 action remains directly reachable; requests can be aimed at loopback and private-network addresses, while the enclosure path additionally exposes response status, content type and length. CVE-2026-82375 carries a CVSS 3.1 score of 7.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, CWE-918) and no public exploit code was identified at time of analysis, with no confirmed active exploitation (CISA KEV); upgrading to Apache Roller 6.1.6 or later removes the outbound Trackback action and stops dereferencing enclosure URLs.
XML external entity (XXE) injection in Apache Roller 6.1.5 lets an authenticated user who holds entry-editing rights on any weblog force the server to fetch and parse an attacker-influenced trackback response with an XML parser that resolves external entities, disclosing files readable by the Roller process account. The Trackback control is hidden in the standard UI, but its Struts2 action remains directly reachable over HTTP and no non-default server configuration is required, so the practical prerequisite is a valid low-privileged account plus a host the attacker controls to serve the malicious trackback XML (CVSS 3.1 7.7 High, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope change reflecting reads outside the application's own data). No public exploit code was identified at the time of analysis, and the vendor-released fix is Apache Roller 6.1.6, which eliminates the outbound trackback response parser.
Cross-weblog authorization bypass in Apache Roller 6.1.5 lets an authenticated user holding authoring rights on one weblog read, modify, or delete resources belonging to another weblog - bookmarks, bookmark folders, media files and directories, entries, categories, and comments - by supplying identifiers that are resolved without being scoped to the acting weblog. The same flaw allows a user with administrator rights on their own weblog to overwrite a victim weblog's Velocity template, whose content is then evaluated when that weblog renders, giving code-in-context execution within the victim's blog. Rated CVSS 7.7 High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L), exploitation requires an authenticated author-level account and knowledge or enumeration of valid foreign resource identifiers; no public exploit was identified at time of analysis. Multi-user shared-hosting installations where weblogs are meant to be isolated are affected, while single-user or single-tenant deployments are not meaningfully exposed.
Server-side request forgery in Apache Roller 6.1.5 allows an authenticated user holding entry-editing rights on a weblog to force the server to issue outbound HTTP requests to attacker-chosen destinations via the legacy outbound Trackback action and entry enclosure handling. No non-default configuration is required because the default Trackback allow-list is empty and therefore permits every destination, and although the Trackback control is hidden in the standard UI its Struts2 action remains directly reachable; requests can be aimed at loopback and private-network addresses, while the enclosure path additionally exposes response status, content type and length. CVE-2026-82375 carries a CVSS 3.1 score of 7.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, CWE-918) and no public exploit code was identified at time of analysis, with no confirmed active exploitation (CISA KEV); upgrading to Apache Roller 6.1.6 or later removes the outbound Trackback action and stops dereferencing enclosure URLs.
XML external entity (XXE) injection in Apache Roller 6.1.5 lets an authenticated user who holds entry-editing rights on any weblog force the server to fetch and parse an attacker-influenced trackback response with an XML parser that resolves external entities, disclosing files readable by the Roller process account. The Trackback control is hidden in the standard UI, but its Struts2 action remains directly reachable over HTTP and no non-default server configuration is required, so the practical prerequisite is a valid low-privileged account plus a host the attacker controls to serve the malicious trackback XML (CVSS 3.1 7.7 High, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope change reflecting reads outside the application's own data). No public exploit code was identified at the time of analysis, and the vendor-released fix is Apache Roller 6.1.6, which eliminates the outbound trackback response parser.
Cross-weblog authorization bypass in Apache Roller 6.1.5 lets an authenticated user holding authoring rights on one weblog read, modify, or delete resources belonging to another weblog - bookmarks, bookmark folders, media files and directories, entries, categories, and comments - by supplying identifiers that are resolved without being scoped to the acting weblog. The same flaw allows a user with administrator rights on their own weblog to overwrite a victim weblog's Velocity template, whose content is then evaluated when that weblog renders, giving code-in-context execution within the victim's blog. Rated CVSS 7.7 High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L), exploitation requires an authenticated author-level account and knowledge or enumeration of valid foreign resource identifiers; no public exploit was identified at time of analysis. Multi-user shared-hosting installations where weblogs are meant to be isolated are affected, while single-user or single-tenant deployments are not meaningfully exposed.