Apache Roller 6.1.7 fixes 15 security vulnerabilities

Apache Roller 6.1.7 fixes 15 security vulnerabilities. Apache Roller 6.1.6 is affected, and most also affect earlier versions. Upgrade to 6.1.7 now.

Every installation should upgrade. Some vulnerabilities need no optional feature. Vulnerabilities were found in these features:

Multiple users and weblogs: member roles, entry preview and user search
Weblog templates and custom themes
Weblog search
Weblog update pings
Request-token (CSRF) protection of administrative actions
Blogroll import from OPML
Planet
AtomPub (off by default)
OpenID sign-in (off by default)

Each CVE links to its advisory.

Important

CVE-2026-105153: XXE in AtomPub entry parsing
CVE-2026-118411: CSRF through GET requests can create an administrator
CVE-2026-123374: Deserialization of weblog update ping responses

Moderate

CVE-2026-105152: Password hash exposure through template objects
CVE-2026-105154: CSRF in Planet administration leads to SSRF
CVE-2026-108338: Stored XSS via AtomPub entry tags
CVE-2026-111824: Stored XSS via custom-theme resource URLs
CVE-2026-118408: Unpublished entries readable through preview
CVE-2026-118409: Commenter email addresses recoverable through search
CVE-2026-118413: Stored XSS via imported blogroll links
CVE-2026-118414: Stored XSS via the weblog description
CVE-2026-122300: Limited members can remove or change published entries

Low

CVE-2026-118405: Email addresses learnable through user search
CVE-2026-118410: Withdrawn AtomPub entries stay in search
CVE-2026-118412: Disabled accounts can sign in through OpenID

Some changes affect existing installations. For example, Planet is now off by default, and the entry editor applies the Limited role to each entry. Read the release notes before you upgrade. After you upgrade, rebuild the search index so it no longer holds commenter email addresses.

6.1.7 also keeps images pasted into the rich text editor when you publish (ROL-2184).

Thanks to the reporters and to everyone who reviewed and tested the fixes.