CVE-2026-82386: apache software foundation apache roller

Vulnerability summary

CVE-2026-82386 is a high (CVSS 7.7) vulnerability in apache software foundation apache roller. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.2% of scored vulnerabilities.

Timeline

1. 28-09-2026
   PublishedVulnerability first disclosed.
2. 29-09-2026
   Last modifiedVulnerability information updated.

Description

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator bookmark-import action. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which uses a hardened parser that disables external entities and document type declarations.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.