Unrated severityNVD Advisory· Published Nov 11, 2026

CVE-2026-49236

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Xmlgraphics Batikinferred
Range: >=1.20
Apache/XML Graphics Batikllm-fuzzy
Range: <=1.19

Patches

Vulnerability mechanics

References

issues.apache.org/jira/browse/BATIK-1394nvd
lists.apache.org/thread.html/xpysqx09ycpj23qk6b10k87pssqx0dk2nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000