Apache Roller 6.1.5 contains an improper restriction of XML external entity references (CWE-611) vulnerability. A user with entry-editing permissions can cause the server to parse an attacker-controlled trackback response with an XML parser that allows external entity resolution. This results in potential disclosure of files accessible to the Roller process. The trackback feature is not visible in the default UI but can be accessed directly without requiring non-default server configurations. The vulnerability is fixed in Apache Roller 6.1.6 by removing the vulnerable outbound trackback response parser.

An attacker with entry-editing rights can exploit this vulnerability to disclose sensitive files readable by the Apache Roller process. This can lead to confidentiality breaches of server files. The vulnerability does not require UI visibility or special server configurations to be exploited. The CVSS 3.1 base score is 7.7 (high severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high confidentiality impact.

Users should upgrade to Apache Roller version 6.1.6 or later, where the vulnerable outbound trackback response parser has been removed. No additional configuration changes are required. There is no indication that temporary workarounds or mitigations exist other than upgrading.