CVE-2026-49236: Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks

Published Nov 11, 2026

Updated

Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache XML Graphics Batik to a version that resolves this vulnerability.
Fixed in 1.20

Event History

Nov 11, 2026

CVE Published

via MITRE·01:23 PM

Data Sourced

via MITRE·01:23 PM

DescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Apache XML Graphics Batik through version 1.19 are affected when they process SVG content such that external-resource same-origin checks are relied upon. The flaw is specifically triggered through SVG color-profile handling with xml:base.

What does an attacker need to exploit the vulnerability?

An attacker needs to supply or cause processing of an SVG that uses a color-profile element and xml:base to bypass Batik's external-resource same-origin checks. The resulting impact is server-side request forgery.

What should teams do to remediate the issue?

Upgrade Apache XML Graphics Batik to version 1.20, which fixes the issue.

CVE-2026-49236: Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should teams do to remediate the issue?