CVE-2026-82385: apache software foundation apache roller

Vulnerability summary

CVE-2026-82385 is a medium (CVSS 6.5) vulnerability in apache software foundation apache roller. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.7% of scored vulnerabilities.

Timeline

1. 28-09-2026
   PublishedVulnerability first disclosed.
2. 29-09-2026
   Last modifiedVulnerability information updated.

Description

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace. Roller treats weblog administrators as untrusted and enables a Velocity sandbox, but the include and parse directives are not confined by it. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which confines includes to the active theme and removes classpath resource loading from weblog rendering.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.