Severity: Important
CVSS 3.1: 7.7 (high) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected versions:
- Apache Roller 4.0 through 6.1.6
Description:
Improper Restriction of XML External Entity Reference in Apache Roller 4.0
through 6.1.6 allows an authenticated user with no weblog permissions to read
files readable by the Roller process and cause the server to issue outbound
HTTP requests to attacker-chosen destinations, by submitting a crafted Atom
entry to the AtomPub endpoint. The entry body is parsed with a parser
configuration that permits external parameter entities and external DTD
subsets, and the parse happens before any per-weblog authorization check and
before any check of whether the AtomPub feature is enabled, so the endpoint is
reachable by any authenticated account on a default installation. Users are
recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub
entries with a hardened XML configuration and rejects AtomPub requests while
the feature is disabled.
Credit:
Kaya Emre Arikan (finder)
References:
https://github.com/apache/roller/pull/198
https://github.com/apache/roller/pull/201
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105153
