Apache Batik must check URL protocol when loading documents (CVE-2026-89326)
Original title: CVE-2026-89326: Apache XML Graphics Batik: Check url protocol when loading document
Apache rates the XML Graphics Batik issue moderate; the notice lists no versions, fix, or exploitation.
Simon Steiner posted CVE-2026-89326 to oss-security on November 11. The issue is in Apache XML Graphics Batik and is titled as a failure to check the URL protocol when loading a document. Apache rates severity moderate. The short notice points to JIRA BATIK-1398 and the CVE record but does not describe versions, a patch, or attacks.
Unconfirmed: Affected versions, a fix, and whether the flaw is exploited are not stated in the notice.
- Severity is listed as moderate.
- The JIRA reference is BATIK-1398.
- No affected or fixed versions appear in the notice.
Impact: URL protocol not checked when loading a document
| Product | Affected |
|---|---|
| Apache XML Graphics Batik | — |
- CVEs
- CVE-2026-89326
- Vendors
- Apache
- Products
- Apache XML Graphics Batik
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89326 | Origin validation error in Apache Batik through 1.19 | — | — |
From the original article
Posted by Simon Steiner on Nov 11 Severity: moderate https://issues. apache. org/jira/browse/BATIK-1398 https://xmlgraphics.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.