UBUNTU-CVE-2026-49236: SSRF

Published Nov 12, 2026

Updated

Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Affected Software

7 affected components

ubuntu/batik*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache XML Graphics Batik to a version that resolves this vulnerability.
Fixed in 1.20

Event History

Nov 12, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Batik versions are affected and what version fixes the issue?

Apache XML Graphics Batik through version 1.19 is affected. Upgrading to version 1.20 fixes the vulnerability.

What condition is involved in exploiting this vulnerability?

The issue involves SVG color-profile handling where an xml:base value can bypass Batik's external-resource same-origin checks. Exploitation therefore depends on processing SVG content that uses this mechanism.