CVE-2026-82385 is an information exposure vulnerability in Apache Roller version 6.1.5. It arises from insufficient sandboxing of Velocity template include and parse directives, allowing a weblog administrator to read arbitrary files on the application classpath, including sensitive configuration files containing secrets. The vulnerability does not require any special configuration and affects any weblog where the administrator can author templates. The issue is resolved in Apache Roller 6.1.6 and later by confining includes to the active theme and disabling classpath resource loading during weblog rendering.

An attacker with weblog administrator privileges can read sensitive files on the application classpath, potentially exposing secrets such as configuration data. This could lead to information disclosure but does not directly impact integrity or availability. The vulnerability requires the attacker to have weblog administrator access, which is a limited privilege level.

Users should upgrade to Apache Roller version 6.1.6 or later, which confines Velocity template includes to the active theme and removes the ability to load classpath resources during weblog rendering. This official fix addresses the vulnerability. No other configuration changes are required.