Apache Roller versions 4.0 through 6.1.6 contain a deserialization of untrusted data vulnerability. This occurs when the XML-RPC client in Roller deserializes Java object data from the response to a weblog update ping, allowing an attacker controlling that response to execute code on the Roller server. The issue is fixed in version 6.1.7, which removes the unsafe deserialization.