CVE-2026-82384

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description An unauthenticated remote attacker can cause the deserialization of attacker-controlled bytes via the XML-RPC endpoint. This occurs because the endpoint accepts vendor extension types that are deserialized during request parsing before authentication. The servlet is mapped unconditionally, meaning parsing happens even if the global XML-RPC feature is disabled. This issue can lead to remote code execution. The affected endpoint is /roller-services/xmlrpc and it specifically accepts ex:serializable data.

Recommendations Upgrade to Apache Roller version 6.1.6 or later.