CVE-2026-82385 Details

A vulnerability in Apache Roller version 6.1.5 allows weblog administrators to access sensitive files on the application classpath, including configuration files with secrets. This issue arises because administrators can create Velocity templates that use include directives to load classpath resources outside the theme namespace. Although Roller applies a Velocity sandbox for weblog administrators, the include and parse directives can bypass this restriction. The vulnerability affects any weblog where the administrator can write templates, without requiring any non-default configuration.

Users are advised to upgrade to Apache Roller version 6.1.6 or later, which restricts include directives to the active theme and eliminates classpath resource loading from weblog rendering.