CVE-2026-105153 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller parses AtomPub entries with a configuration that allows external entities, so any authenticated account can submit a crafted Atom entry. An attacker can read files the Roller process can access and make the server send outbound HTTP requests to destinations of their choosing.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Apache Roller installation from 4.0 through 6.1.6 is exposed, because the AtomPub parse happens before the weblog permission check and before the feature-enabled check, so any authenticated account reaches it on a default install. Sites that run Roller must check their version and upgrade; the vulnerability is reached by any user account, not only weblog owners.
Not affected if no-authenticated-accounts, version-6.1.7-or-later
Who cares apache-roller, java, self-hosted
pom.xml of the build; versions 4.0 through 6.1.6 are affected./roller-services/app/) is reachable by authenticated users.6.1.7 or later.Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.