Is CVE-2026-105153 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105153 being exploited in the wild.

How severe is CVE-2026-105153?

High severity, with a CVSS score of 7.7, published 11 November 2026.

Which products and versions are affected?

Apache Roller 4.0 through 6.1.6.

How is CVE-2026-105153 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105153?

Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105153: Apache Roller XML external entity injection in AtomPub

CVE-2026-105153 · Severity: high · CVSS 7.7 · Published 2026-11-11

Apache Roller is a blogging platform that includes an AtomPub interface for publishing content. This vulnerability allows an authenticated user without weblog permissions to read arbitrary files accessible to the Roller process and make the server connect to attacker-controlled servers by submitting a maliciously crafted blog entry. An attacker could steal sensitive data or cause the server to participate in network attacks.

Technologies: Apache Roller. Vendors: Apache.

Quick answers

Is CVE-2026-105153 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105153 being exploited in the wild.
How severe is CVE-2026-105153?: High severity, with a CVSS score of 7.7, published 11 November 2026.
Which products and versions are affected?: Apache Roller 4.0 through 6.1.6.
Is there a fix for CVE-2026-105153?: Yes: fixed in Apache Roller 6.1.7 or later. Until then: Disable the AtomPub feature by setting webservices.enableAtomPub to false until an upgrade to 6.1.7 or later is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105153 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105153?: Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Roller 6.1.7 or later

Disable the AtomPub feature by setting webservices.enableAtomPub to false until an upgrade to 6.1.7 or later is available.

Technical details

The AtomPub endpoint parses Atom entries using an XML parser configured to permit external parameter entities and DTD subsets, enabling XXE (XML External Entity) attacks. The vulnerability occurs because XML parsing happens before authorization checks and before verification that the AtomPub feature is enabled, making the endpoint reachable by any authenticated account on default installations. An attacker can read files or trigger arbitrary HTTP outbound requests from the server.

Affected products

Apache Roller 4.0 through 6.1.6

Timeline

2026-11-11: disclosed: CVE-2026-105153 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.