Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks

published 2026-11-11 20h ago modified 2026-11-11 14h ago also EUVD-2026-123477

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Is CVE-2026-49236 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.xmlgraphics:batik-bridge	<=1.19.0	no fix listed

Affected products

Apache Software Foundation Apache XML Graphics Batik

Classification

Weakness

CWE-918 Server-Side Request Forgery

References

lists.apache.org /thread.html/xpysqx09ycpj23qk6b10k87pssqx0dk2
vendor-advisory
issues.apache.org /jira/browse/BATIK-1394
issue-tracking
openwall.com /lists/oss-security/2026/11/11/18

Sources

CVE List CVE-2026-49236
NVD CVE-2026-49236

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.