DEBIAN-CVE-2026-49236: SSRF
Published Nov 11, 2026
·Updated
Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Affected Software
3 affected componentsFixes available
debian/batik*
debian/batik*
debian/batik<1.20-1
1.20-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/batikto a version that resolves this vulnerability.Fixed in 1.20-1 - Upgrade
Upgrade
Apache XML Graphics Batikto a version that resolves this vulnerability.Fixed in 1.20
Event History
Nov 11, 2026
CVE Published
via OSV·02:17 PM
Data Sourced
via OSV·02:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which Batik versions are affected and what version fixes the issue?
Apache XML Graphics Batik versions through 1.19 are affected. Upgrading to version 1.20 fixes the issue.
2
What component or SVG feature is involved in this vulnerability?
The issue involves SVG color-profile handling, where an xml:base bypass can evade Batik's external-resource same-origin checks.