CVE-2026-82386
Apache Roller: XML external entity processing in OPML bookmark import
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator bookmark-import action. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which uses a hardened parser that disables external entities and document type declarations.
| CWE | CWE-611 |
| Vendor | apache software foundation |
| Product | apache roller |
| Published | Sep 28, 2026 |
| Last Updated | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache roller
Be the first to know when new high vulnerabilities affecting apache software foundation apache roller are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Apache Software Foundation / Apache Roller
6.1.5
References
Credits
n0mi1k