Description

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator bookmark-import action. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which uses a hardened parser that disables external entities and document type declarations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-28T08:16:42.527Z",
  "pubdate": "2026-09-28T08:16:42.527Z",
  "executiveSummary": "Apache Roller 6.1.5 is susceptible to an Improper Restriction of XML External Entity (XXE) Reference vulnerability. This security flaw originates from the application's failure to properly configure the XML parser during the processing of imported OPML documents.\nThe vulnerability allows an authenticated weblog administrator to perform unauthorized operations, including reading arbitrary files residing on the host filesystem that are accessible to the Roller process, and conducting Server-Side Request Forgery (SSRF) to probe internal network infrastructure.\nThe attack is triggered by the administrator-level bookmark-import action, which does not require non-default configuration or additional plugins to exploit. Because the parser does not disable external entity resolution or Document Type Declarations (DTDs), a malicious actor can supply a crafted OPML file containing external entity references to facilitate data exfiltration or internal network reconnaissance.\nThe risk is significant as it provides an attacker with elevated privileges the capability to bypass system access controls and interact with internal network resources. The vulnerability is remediated in version 6.1.6, which implements a hardened XML parser configuration.",
  "technicalDetails": "The vulnerability resides within the bookmark-import functionality of Apache Roller 6.1.5. The root cause is the inadequate configuration of the underlying XML parser used to process uploaded OPML files. The parser fails to restrict the resolution of external entities and the processing of Document Type Declarations (DTDs), which are core features of the XML specification that, when left enabled in an untrusted context, allow an attacker to redefine entity references to point to arbitrary local files or external URI resources.\nThe attack flow initiates when an authenticated user with weblog administrator privileges accesses the bookmark-import action. The application accepts an XML-based OPML document provided by the user. By injecting a crafted DTD into the OPML structure, the attacker can define an external entity that references local system files (e.g., /etc/passwd or application configuration files) or internal network resources using protocols such as HTTP or file://.\nUpon submission, the vulnerable parser processes the malicious XML document. When the parser encounters the defined external entity reference during document parsing, it automatically attempts to resolve the external resource. For file-based entities, the parser reads the content of the target file and attempts to include it in the application's output or processing flow. For network-based entities, the server initiates an outbound request to the target internal IP address or port, effectively bypassing internal network segmentation and firewall restrictions.\nBecause the bookmark-import action is a legitimate administrative feature, the exploitation does not require special configurations or non-default setups, making the default installation state vulnerable. The impact of this exploit is multi-faceted: it leads to the disclosure of sensitive server-side information, such as environment variables, source code, or configuration files, and allows the application server to be utilized as a proxy for internal network scanning and interaction.\nAffected versions are strictly limited to Apache Roller 6.1.5. The successful exploitation requires active authentication as a weblog administrator. Post-exploitation, the attacker gains the ability to exfiltrate critical data and map internal network architecture that is otherwise hidden from the public internet. The lack of proper DTD and external entity validation in the parser implementation is the specific component failure that facilitates this injection attack."
}