Roller: free and open source Java blog software

Apache Roller 6.1.6 fixes 18 security vulnerabilities. Apache Roller 6.1.5 is affected. Upgrade to 6.1.6 now.

Every installation should upgrade. Some vulnerabilities need no optional feature. Vulnerabilities were found in these features:

• Comments & Trackbacks, LDAP comment authentication
• Multiple users and weblogs
• Media file uploads
• The frontpage theme
• XML-RPC (MetaWeblog or Blogger API), even when disabled
• AtomPub with WSSE authentication
• OAuth

Each CVE links to its advisory.

Critical

• CVE-2026-82384: Unauthenticated XML-RPC deserialization

Important

• CVE-2026-82348: Cross-weblog resource tampering
• CVE-2026-82376: XXE in trackback parser
• CVE-2026-82380: CSRF protection bypass
• CVE-2026-82381: Stored XSS in authoring UI
• CVE-2026-82383: Anonymous setup tampering
• CVE-2026-82385: Velocity template sandbox escape
• CVE-2026-82386: XXE in OPML import
• CVE-2026-86507: Stored XSS in comment moderation

Moderate

• CVE-2026-82375: SSRF via trackback and enclosure
• CVE-2026-82377: Missing XML-RPC weblog authorization
• CVE-2026-82378: OAuth endpoint trusts request identity
• CVE-2026-82379: WSSE authentication replay
• CVE-2026-82382: Reflected XSS in frontpage
• CVE-2026-82387: Stored XSS via media type
• CVE-2026-82546: Stored XSS via trackback links
• CVE-2026-91204: Stored javascript: URI in comments
• CVE-2026-91206: Reflected XSS in LDAP authenticator

Some changes affect existing installations. Read the release notes before you upgrade.

Thanks to the reporters and to everyone who reviewed and tested the fixes.

The Apache Roller project is pleased to announce Apache Roller 6.1.6.

Roller is a full-featured, multi-user and group-blog server written in Java, suitable for blog sites large and small.

This is a maintenance release with bug fixes and small improvements. Users of 6.1.5 and earlier are encouraged to upgrade.

A few changes affect existing installations:

• Initial setup now requires a one-time token that Roller prints to the server log. This applies both to a new installation and to a restart that migrates the database schema.
• Incoming and outbound Trackback support is removed. The endpoint no longer exists and the entry editor no longer sends pings.
• WSSE AtomPub authentication is retired. The authentication.method setting now takes basic or oauth, and an installation still set to wsse fails on startup, so change it before you upgrade.
• Media file content types are derived from file content rather than from the upload request.
• Table detection during installation is scoped to the database the connection points at. This fixes MySQL installs into an empty schema on a server that also hosts another Roller database.

Downloads · Release notes

The Apache Roller project is pleased to announce the release of Roller 6.1.4! This release includes several updates and improvements to enhance the security, stability, and functionality of your Roller installations.

Dowload the latest release from: 

    https://www.apache.org/dyn/closer.cgi/roller/roller-6.1/v6.1.4

Key Changes in Apache Roller 6.1.4

Safer defaults

As of Roller 6.1.4, several default settings have been updated to enhance security for multi-user weblog sites:

• HTML content sanitization: Roller now sanitizes all HTML content by default to prevent malicious content. This is controlled by the weblogAdminsUntrusted=true property in your roller-custom.properties file.
• Custom themes and file-uploads disabled by default. You can enable this feature via the Server Admin page if you trust your users, as these features can pose security risks.
• Better CSRF and XSS protection by user-specific and one-time-use salts.

Dependency updates

Over 20 mostly minor dependency updates including Spring, Eclipse-Link JPA, Log4j, Lucene, and more.

Bug fixes

Fixed some bugs that impacted category create, update and delete.

The Apache Roller project is pleased to announce the availability of Roller 6.1.3, a release that includes some minor bug fixes, dependency updates and input sanitization changes. If you run a multi-user Roller site and you do not trust your users, you should upgrade as this release fixed a couple of XSS vulnerabiltiies.

https://roller.apache.org/downloads/downloads.html

You can find some more details about the release in the vote thread here:

https://lists.apache.org/thread/xnnf63bdzmq7z08ptdptyg5c30rfvzq5

Thanks to all who helped out with this release!

The Apache Roller project is pleased to announce the availability of Roller 6.1.1, a release that upgrades many dependencies including  Spring, Struts, Lucene, Log4J, Guice and Bouncy Castle. The release and convenience binaries can be found on the Roller project download page here: