Improper XML External Entity Handling in Apache Roller by Apache

CVE-2026-105153

What is CVE-2026-105153?

An issue has been identified in Apache Roller versions 4.0 through 6.1.6 that enables an authenticated user lacking weblog permissions to exploit improper restrictions on XML External Entity references. This vulnerability allows for unauthorized reading of files accessible by the Roller process and enables the server to execute outbound HTTP requests directed by an attacker. This occurs when a malicious user submits a specially crafted Atom entry to the AtomPub endpoint. The underlying parser configuration permits external parameter entities and DTD subsets, leading to exploitation prior to any per-weblog authorization checks or validation of the AtomPub feature being enabled. Users should upgrade to Apache Roller 6.1.7 or newer, where the AtomPub entries are processed with enhanced security measures that reject unauthorized requests and enforce proper configuration.

References