CVE-2026-82385

Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Published Sep 28, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace. Roller treats weblog administrators as untrusted and enables a Velocity sandbox, but the include and parse directives are not confined by it. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which confines includes to the active theme and removes classpath resource loading from weblog rendering.

Analysis

Technical impact

A weblog administrator can author a Velocity template that uses an include directive to load a classpath resource outside the theme namespace, bypassing the Velocity sandbox. This allows the reading of application classpath files, including configuration files containing secrets. The consequence is the exposure of sensitive information through an information‑disclosure vulnerability.

Affected Systems

Apache Roller versions preceding 6.1.6, notably 6.1.5, are impacted. Any weblog whose administrator has the ability to author templates is vulnerable, regardless of additional configuration changes.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be a weblog administrator and to author a template; no non‑default configuration is needed. The attack vector is therefore local to the web application context, relying on the presence of an privileged administrator user.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Roller

unknown

Version	Status	Constraints
`6.1.5`	affected	—

No data.

Vendor Product Versions

Apache

Roller

Version	Status	Scheme	Platform
`6.1.5`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache Roller to version 6.1.6 or later, which confines include directives to the active theme and removes classpath resource loading from weblog rendering.
Restrict the ability to author Velocity templates to only trusted users or disable template authoring if it is not a required feature for the service.
Audit existing templates for include directives that load classpath resources and remove or sanitize them; monitor application logs for anomalous include usage.

Generated by OpenCVE AI on September 28, 2026 at 09:53 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.276% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/09/25/18
https://github.com/apache/roller/pull/172
https://lists.apache.org/thread/wfy8jrwf4xk6r8xgd4rosnxwjwdn4znx

History

Sep 29, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 28, 2026 11:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache roller
Vendors & Products		Apache Apache roller

Sep 28, 2026 9:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/09/25/18

Sep 28, 2026 8:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace. Roller treats weblog administrators as untrusted and enables a Velocity sandbox, but the include and parse directives are not confined by it. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which confines includes to the active theme and removes classpath resource loading from weblog rendering.
Title		Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files
Weaknesses		CWE-200
References		https://github.com/apache/roller/pull/172 https://lists.apache.org/thread/wfy8jrwf4xk6r8xgd4rosnxwjwdn4znx
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`