37 matches found
CVE-2026-118410
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content...
CVE-2026-108338
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-105153
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...
CVE-2026-118410
Apache Roller versions 4.0 through 6.1.6 are vulnerable to an Exposure of Resource to Wrong Sphere (CWE-668) via the AtomPub API . Although the AtomPub functionality is disabled by default, an unauthenticated visitor can read entries that have been withdrawn to draft status by an author. While th...
EUVD-2026-123509
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content...
CVE-2026-118410
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content...
CVE-2026-118410 Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content...
CVE-2026-118410 Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content...
CVE-2026-108338
Apache Roller versions 5.0.1 through 6.1.6 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation, where the tag filter allows HTML characters in tag names. Specifically, the bundled gaurav , fauxcoly ...
EUVD-2026-123503
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-108338
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-108338 Apache Roller: Stored cross-site scripting through AtomPub entry tags
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-108338 Apache Roller: Stored cross-site scripting through AtomPub entry tags
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
EUVD-2026-123422
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...
CVE-2026-105153 Apache Roller: XML external entity processing in AtomPub entry parsing
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...
CVE-2026-105153
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...
CVE-2026-105153 Apache Roller: XML external entity processing in AtomPub entry parsing
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...
CVE-2026-105153
Apache Roller versions 4.0 through 6.1.6 are vulnerable to an Improper Restriction of XML External Entity Reference (CWE-611). An authenticated user with no weblog permissions can submit a crafted Atom entry to the AtomPub endpoint to read files accessible by the Roller process or force the serve...
CVE-2026-105153: Apache Software Foundation Apache Roller: Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user…
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...
PT-2026-145173
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...