CVE-2026-82386

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Improper restriction of XML External Entity (XXE) references allows a weblog administrator to read files accessible by the Roller process and access internal network addresses. This occurs when importing a crafted OPML document because the bookmark import parser fails to disable external entity resolution. The issue is accessible via the administrator bookmark-import action and requires no non-default configuration.

Recommendations Upgrade Apache Roller to version 6.1.6 or later.