CVE-2026-49236 · Package
NO FIX YET · SEE WHAT TO DO
Apache XML Graphics Batik through 1.19 lets a crafted SVG file bypass its same-origin checks on external resources through an xml:base attribute in a color-profile element. An attacker can make the server that renders the SVG send requests to URLs of their choosing.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Apache Batik on the server to parse or render SVG files, especially SVG uploaded or supplied by users, are exposed. Applications that only use Batik on trusted, internal SVG content or do not use it at all can skip this.
Not affected if no-svg-rendering, trusted-input-only
Who cares batik, java, svg
batik in pom.xml, build.gradle or package-lock.json.1.19 and below.1.20.Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks
This issue affects Apache XML Graphics Batik: through 1.19.
Users are recommended to upgrade to version 1.20, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.