# CVE-2026-82385: Apache Roller information disclosure in Velocity templates

Source: https://junglewise.ai/threats/cve-2026-82385-exposure-of-sensitive-information-to-an-unauthorized-actor-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-82385 · Severity: medium · CVSS 6.5 · Published 2026-09-28

Apache Roller, a weblog publishing platform, allows weblog administrators to author Velocity templates that can read sensitive files from the application, including configuration files containing secrets. An attacker with administrator privileges on a weblog can exploit this by crafting a malicious template to access protected resources. This vulnerability affects any Roller installation where administrators have template authoring capabilities.

Technologies: [Apache Roller](https://junglewise.ai/threats/technologies/roller). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82385 being exploited in the wild.

**How severe is CVE-2026-82385?** Medium severity, with a CVSS score of 6.5, published 28 September 2026.

**Which products and versions are affected?** Apache Roller 6.1.5 and earlier.

**Is there a fix for CVE-2026-82385?** A patch was published on 2026-09-05: Fix merged in PR #172; available in 6.1.6 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82385 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82385?** Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Roller's Velocity template engine, which fails to properly sandbox the include and parse directives despite implementing a general Velocity sandbox for untrusted weblog administrators. An attacker with weblog admin privileges can use these directives to load classpath resources outside the theme namespace, including application configuration files. The fix in Roller 6.1.6+ confines includes to the active theme, removes classpath resource loading from weblog rendering, and implements an include event handler to restrict include targets.

## Affected products

- Apache Roller 6.1.5 and earlier

## Timeline

- 2026-09-28: disclosed
- 2026-09-05: patched: Fix merged in PR #172; available in 6.1.6 and later

## References

- [https://github.com/apache/roller/pull/172](https://github.com/apache/roller/pull/172)
- [https://lists.apache.org/thread/wfy8jrwf4xk6r8xgd4rosnxwjwdn4znx](https://lists.apache.org/thread/wfy8jrwf4xk6r8xgd4rosnxwjwdn4znx)

## Related threats

- [Apache Roller XML-RPC deserialization remote code execution](https://junglewise.ai/threats/cve-2026-123374-deserialization-of-untrusted-data-vulnerability-in-apache-roller)
- [Apache Roller missing authorization in entry editor](https://junglewise.ai/threats/cve-2026-122300-missing-authorization-vulnerability-in-apache-roller-4-0-through)
- [Apache Roller stored cross-site scripting in weblog menu](https://junglewise.ai/threats/cve-2026-118414-improper-neutralization-of-input-during-web-page-generation)
- [Apache Roller stored cross-site scripting in blogroll import](https://junglewise.ai/threats/cve-2026-118413-improper-neutralization-of-input-during-web-page-generation)
- [Apache Roller CSRF allowing unauthenticated administrator account creation](https://junglewise.ai/threats/cve-2026-118411-cross-site-request-forgery-csrf-in-apache-roller-5-0-1-through-6)