Apache Batik must check URL protocol when loading documents (CVE-2026-89326)
Apache rates the XML Graphics Batik issue moderate; the notice lists no versions, fix, or exploitation.
34
CVE-2026-89326
Origin validation error in Apache Batik through 1.19
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache XML Graphics Batik's same-origin check for external resources does not compare the URL protocol, so origin validation can be bypassed when a document is loaded. An attacker who can cause Batik to load a document may reach external resources that the check should block. Apache XML Graphics Batik through 1.19 is affected.
What to do: Upgrade Apache XML Graphics Batik to 1.20, which fixes the protocol check.
| Product | Affected | Fixed in |
|---|---|---|
| Apache XML Graphics Batik | through 1.19 | 1.20 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
- Weakness
- CWE-346