{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/roller-4.0-through-6.1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:roller:4.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:roller:6.1.6:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-105153"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Roller (4.0 through 6.1.6)"],"_cs_severities":["high"],"_cs_tags":["xxe","ssrf","webserver","cve-2026-105153"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Roller 4.0 through 6.1.6 is affected by an XML External Entity (XXE) vulnerability (CVE-2026-105153). An authenticated user can submit a crafted Atom entry to the AtomPub endpoint, causing the server to parse XML with an insecure configuration. The parser enables external parameter entities and external DTD subsets. Crucially, this parsing occurs prior to weblog-level authorization checks and before validation of whether the AtomPub feature is enabled, allowing exploitation on default installations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform arbitrary file reads (constrained to files readable by the Roller process) and trigger outbound HTTP requests (SSRF) from the server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Apache Roller 6.1.7 or later, which implements a hardened XML parser configuration and enforces feature-disabled checks prior to parsing.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unexpected POST requests to the AtomPub endpoint, particularly those originating from accounts lacking administrative or weblog-creation privileges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T14:05:20Z","date_published":"2026-11-11T14:05:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-roller-xxe-cve-2026-105153/","summary":"Apache Roller 4.0 through 6.1.6 contains an XML External Entity (XXE) vulnerability in its AtomPub endpoint that permits unauthorized file reads and server-side request forgery (SSRF).","title":"Apache Roller: XML External Entity injection (CVE-2026-105153)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-roller-xxe-cve-2026-105153/"}],"language":"en","title":"CraftedSignal Threat Feed - Roller (4.0 Through 6.1.6)","version":"https://jsonfeed.org/version/1.1"}