---
id: "CVE-2026-105153"
page: "https://infrastack.ai/live/CVE-2026-105153"
kind: "vulnerability"
aliases: ["CVE-2026-105153"]
title: "Apache Roller: XXE in AtomPub lets logged-in users read server files"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-roller", "java", "package", "self-hosted"]
not_affected_if: ["no-authenticated-accounts", "version-6.1.7-or-later"]
published_at: "2026-11-11T13:17:12+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:29:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105153", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Apache Roller: XXE in AtomPub lets logged-in users read server files

Link for people: https://infrastack.ai/live/CVE-2026-105153 (this .md is for agents)

Apache Roller parses AtomPub entries with a configuration that allows external entities, so any authenticated account can submit a crafted Atom entry. An attacker can read files the Roller process can access and make the server send outbound HTTP requests to destinations of their choosing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Roller version in the deployed WAR or the `pom.xml` of the build; versions `4.0` through `6.1.6` are affected.
- Check whether the AtomPub endpoint (`/roller-services/app/`) is reachable by authenticated users.

## Fix

- Apache Roller: upgrade to `6.1.7` or later.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105153

## From the sources

Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_