Deserialization Vulnerability in Apache Roller Affects User Security

CVE-2026-123374

What is CVE-2026-123374?

A deserialization vulnerability in Apache Roller allows a malicious actor to exploit the XML-RPC client during a weblog update ping. If an attacker controls the response sent to Roller, they can execute arbitrary code within the server process. This issue presents significant risks to user security and data integrity. Users are urged to upgrade to version 6.1.7 and above, which mitigates the risk by eliminating unsafe deserialization practices.

References