Apache Roller: XML External Entity injection (CVE-2026-105153)

Apache Roller 4.0 through 6.1.6 is affected by an XML External Entity (XXE) vulnerability (CVE-2026-105153). An authenticated user can submit a crafted Atom entry to the AtomPub endpoint, causing the server to parse XML with an insecure configuration. The parser enables external parameter entities and external DTD subsets. Crucially, this parsing occurs prior to weblog-level authorization checks and before validation of whether the AtomPub feature is enabled, allowing exploitation on default installations.

Impact

Successful exploitation allows an authenticated user to perform arbitrary file reads (constrained to files readable by the Roller process) and trigger outbound HTTP requests (SSRF) from the server.

Recommendation

• Upgrade to Apache Roller 6.1.7 or later, which implements a hardened XML parser configuration and enforces feature-disabled checks prior to parsing.
• Audit access logs for unexpected POST requests to the AtomPub endpoint, particularly those originating from accounts lacking administrative or weblog-creation privileges.