Apache Roller: XML external entity processing in AtomPub
Summary
Apache Roller versions 4.0 through 6.1.6 process external XML entities in the AtomPub endpoint. An authenticated user, even one without any weblog permissions, can submit a crafted Atom entry to read files readable by the Roller process and make the server send outbound HTTP requests to attacker-chosen destinations. The entry is parsed before the authorization check and before the AtomPub enable check, so according to the CVE text any valid account can reach the endpoint on a default installation.
Affected
- Apache Roller 4.0 through 6.1.6
- Default configuration: the CNA record lists the default as unknown; the CVE text says the endpoint is reachable on a default installation.
Fixed in
- Apache Roller 6.1.7 or later (the final 6.1.7 release should be confirmed on the Apache download page before upgrading)
Workaround
- No vendor workaround is documented.
- If AtomPub is not needed, restrict access to /roller-services/app/ at the reverse proxy or WAF. Disabling the feature in Roller may not stop the XML parsing, so test this first.
- Restrict outbound connections from the Roller server to limit server-side request forgery.
Exploitation
- No known exploitation in the wild according to available threat intelligence.
- No public proof of concept found at the time of research; recheck in the coming days.
Our recommendation
- Inventory all Roller instances and their versions; treat 4.0 through 6.1.6 as vulnerable.
- Upgrade to 6.1.7 or later once the final release is confirmed; prioritise internet-facing instances.
- Until patched, apply the workarounds above.
- Review user accounts, remove unneeded ones, and check the file permissions of the Roller service account; rotate secrets if misuse is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Roller pull request #198 (AtomPub servlet) github.com
- Apache Roller pull request #201 (Secure XML parsing) github.com
- Apache mailing list thread lists.apache.org
- Threat Radar entry for CVE-2026-105153 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:23.
Original description (NVD)
Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.