CVE-2026-49236

Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks

Unrated

Apache Batik Bridge

Published Nov 11, 2026, 13:23 UTC

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.