Threats affecting pkg:github/Apache Roller

Apache Roller versions 4.0 through 6.1.6 are affected by a deserialization of untrusted data vulnerability (CWE-502). This occurs when the XML-RPC client in Roller deserializes Java object data from a weblog update ping response, allowing an attacker controlling that response to execute code within the Roller server process. The issue is resolved in version 6.1.7, which removes the unsafe deserialization.

CVE-2026-82546 is a cross-site scripting (XSS) vulnerability in Apache Roller 6.1.5. It allows an unauthenticated remote attacker to store a crafted comment-author URL via the Trackback endpoint when comments and Trackbacks are enabled on a published entry. The default settings permit the malicious URL to be approved and rendered as an active link, enabling script execution in the context of the weblog's origin. Apache Roller 6.1.6 and later remove Trackback support and suppress non-HTTP(S) comment-author links to mitigate this issue. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.