CVE-2026-82384 Details

A deserialization vulnerability has been identified in Apache Roller version 6.1.5. This issue allows an unauthenticated remote attacker to manipulate the deserialization process by sending attacker-controlled data through the XML-RPC endpoint. The vulnerability arises because the endpoint accepts vendor extension types that are deserialized during request processing, prior to any authentication checks. Notably, the XML-RPC servlet is always active, even if the global XML-RPC feature is disabled, and no special configuration is needed to exploit this issue. The deserialization flaw could be exploited to execute remote code on the server.

Users are advised to upgrade to Apache Roller version 6.1.6 or later, which disables the vulnerable extension types and properly handles requests when the XML-RPC feature is turned off.