Cve-2026-105153 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-105153/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 14:05:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Roller: XML External Entity injection (CVE-2026-105153)https://feed.craftedsignal.io/briefs/2026-11-apache-roller-xxe-cve-2026-105153/Wed, 11 Nov 2026 14:05:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-roller-xxe-cve-2026-105153/Apache Roller 4.0 through 6.1.6 contains an XML External Entity (XXE) vulnerability in its AtomPub endpoint that permits unauthorized file reads and server-side request forgery (SSRF).Apache Roller 4.0 through 6.1.6 is affected by an XML External Entity (XXE) vulnerability (CVE-2026-105153). An authenticated user can submit a crafted Atom entry to the AtomPub endpoint, causing the server to parse XML with an insecure configuration. The parser enables external parameter entities and external DTD subsets. Crucially, this parsing occurs prior to weblog-level authorization checks and before validation of whether the AtomPub feature is enabled, allowing exploitation on default installations.

Impact

Successful exploitation allows an authenticated user to perform arbitrary file reads (constrained to files readable by the Roller process) and trigger outbound HTTP requests (SSRF) from the server.

Recommendation

  • Upgrade to Apache Roller 6.1.7 or later, which implements a hardened XML parser configuration and enforces feature-disabled checks prior to parsing.
  • Audit access logs for unexpected POST requests to the AtomPub endpoint, particularly those originating from accounts lacking administrative or weblog-creation privileges.
]]>highadvisoryxxessrfwebservercve-2026-105153