Batik SVG color-profile xml:base bypasses same-origin checks (CVE-2026-49236)
Apache rates the Batik external-resource bypass moderate; the oss-security note does not list versions or a fix.
42
CVE-2026-49236
SSRF in Apache Batik via SVG color-profile xml:base
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache XML Graphics Batik fails to enforce same-origin checks on external resources when an SVG color-profile uses xml:base, allowing server-side request forgery. An attacker who can supply SVG that Batik processes can make the server request a location of their choosing. This affects Batik through 1.19.
What to do: Upgrade Apache XML Graphics Batik to version 1.20, which fixes the color-profile xml:base bypass.
| Product | Affected | Fixed in |
|---|---|---|
| Apache XML Graphics Batik | through 1.19 | 1.20 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
- Weakness
- CWE-918