CVE-2026-105153

Name of the Vulnerable Software and Affected Versions Apache Roller versions 4.0 through 6.1.6

Description Improper restriction of XML External Entity (XXE) references allows an authenticated user without weblog permissions to read files accessible by the Roller process and force the server to send outbound HTTP requests to arbitrary destinations. This occurs when a crafted Atom entry is submitted to the AtomPub endpoint. The issue stems from a parser configuration that permits external parameter entities and external DTD subsets. The parsing process occurs before per-weblog authorization checks and before verifying if the AtomPub feature is enabled, making the endpoint accessible to any authenticated account in a default installation.

Recommendations Upgrade Apache Roller to version 6.1.7 or later.