PatchTheCVEroller vulnerabilities and fixes
Recent CVEs affecting roller, with upgrade or downgrade steps. 2 tracked.
roller has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-04-14. Highest priority: CVE-2025-24859 (score 52/100).
- CVE-2025-24859 HIGH 8.8 UPGRADE A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are
- CVE-2024-46911 MEDIUM 4.7 UPGRADE Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller
FAQ
How do I fix roller vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is roller being exploited right now?
None of the tracked roller CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which roller CVE should I patch first?
CVE-2025-24859 currently ranks highest (52/100): A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are.