PT-2026-145186
CVE-2026-123374
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache Roller versions 4.0 through 6.1.6
Description
An issue exists where the XML-RPC client deserializes Java object data received in responses when sending a weblog update ping. An attacker controlling the response can execute arbitrary code within the server process. Deserialization is the process of converting a data format, such as XML, back into an object that can be used by a program.
Recommendations
Upgrade to version 6.1.7.
Found an issue in the description? Have something to add? Feel free to write us 👾