Severity: Moderate
CVSS 3.1: 7.4 (high) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected versions:
- Apache Roller 6.1.5
Description:
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an
authenticated user with entry-editing rights on a weblog to cause outbound HTTP
requests to attacker-chosen destinations through legacy outbound Trackback and
entry enclosure handling. The Trackback control is hidden in the standard UI,
but its action remains directly reachable; the enclosure path is relevant only
when an author supplies an enclosure URL. No non-default server configuration
is required, and the default empty Trackback allow-list permits all
destinations. Requests can reach loopback and private-network addresses, while
enclosure handling exposes response status, content type, and length. Users are
recommended to upgrade to Apache Roller 6.1.6 or later, which removes the
outbound trackback action and stops dereferencing enclosure URLs.
Credit:
meifukun (finder)
n0mi1k (finder)
References:
https://github.com/apache/roller/pull/175
https://github.com/apache/roller/pull/163
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-82375
