Batik SVG color-profile xml:base bypasses same-origin checks (CVE-2026-49236)
Original title: CVE-2026-49236: Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks
Apache rates the Batik external-resource bypass moderate; the oss-security note does not list versions or a fix.
Simon Steiner posted CVE-2026-49236 to oss-security on November 11. In Apache XML Graphics Batik, an SVG color-profile xml:base value can bypass same-origin checks on external resources. The notice gives severity as moderate and points to the Apache XML Graphics site and the CVE record. Affected and fixed versions are not in the snippet.
Unconfirmed: The feed snippet does not state affected versions, a fixed release, or whether the issue is exploited.
- Severity is listed as moderate.
- Posted by Simon Steiner on November 11.
- The bypass uses SVG color-profile xml:base against Batik external-resource checks.
Impact: Bypass of Batik external-resource same-origin checks
| Product | Affected |
|---|---|
| Apache XML Graphics Batik | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-49236 | SSRF in Apache Batik via SVG color-profile xml:base | — | — |
From the original article
Posted by Simon Steiner on Nov 11 Severity: moderate https://xmlgraphics. apache. org/ https://www.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.