{"id":"CVE-2026-49236","kind":"vulnerability","aliases":["CVE-2026-49236"],"related":[],"title":"Apache Batik: SVG color-profile xml:base bypass enables server-side request forgery","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.","summary":"Apache XML Graphics Batik through 1.19 lets a crafted SVG file bypass its same-origin checks on external resources through an xml:base attribute in a color-profile element. An attacker can make the server that renders the SVG send requests to URLs of their choosing.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["batik","java","package","svg"],"not_affected_if":["no-svg-rendering","trusted-input-only"],"how_to_check":"- Find Batik in your build files or dependencies, for example by searching for `batik` in `pom.xml`, `build.gradle` or `package-lock.json`.\n- Check the Batik version in use against `1.19` and below.\n- Check whether your application renders untrusted SVG files with Batik on the server.","fix":"- Apache XML Graphics Batik: upgrade to `1.20`.","status":"open","published_at":"2026-11-11T14:17:43+00:00","first_seen_at":"2026-11-11T14:27:32+00:00","triaged_at":"2026-11-11T14:29:31+00:00","updated_at":"2026-11-11T14:29:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T14:29:31Z","model":"claude-haiku-5-5","output":{"fix":"- Apache XML Graphics Batik: upgrade to `1.20`.","reach":"internet","title":"Apache Batik: SVG color-profile xml:base bypass enables server-side request forgery","impact":"medium","summary":"Apache XML Graphics Batik through 1.19 lets a crafted SVG file bypass its same-origin checks on external resources through an xml:base attribute in a color-profile element. An attacker can make the server that renders the SVG send requests to URLs of their choosing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["java","batik","svg"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server sends requests to attacker-chosen internal or external URLs","analyst_note":"Confirm the exact affected range and whether the default configuration renders external color profiles; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-49236.","how_to_check":"- Find Batik in your build files or dependencies, for example by searching for `batik` in `pom.xml`, `build.gradle` or `package-lock.json`.\n- Check the Batik version in use against `1.19` and below.\n- Check whether your application renders untrusted SVG files with Batik on the server.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-svg-rendering","trusted-input-only"],"who_is_affected":"Applications that use Apache Batik on the server to parse or render SVG files, especially SVG uploaded or supplied by users, are exposed. Applications that only use Batik on trusted, internal SVG content or do not use it at all can skip this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000763,"input_tokens":4558,"output_tokens":614,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-49236':18A,21A '1.19':31B,108C '1.20':116C 'affect':102C 'apach':1A,26B,82C,103C 'attack':58B 'attribut':50B 'base':8A,49B,91C 'batik':2A,22B,29B,85C,93C,106C 'bypass':9A,37B,92C 'check':42B,99C 'choos':73B 'color':5A,54B,88C 'color-profil':4A,53B,87C 'craft':34B 'cve':16A,19A 'element':56B 'enabl':10A 'extern':44B,94C 'file':36B 'fix':118C 'forgeri':15A,78C 'graphic':28B,84C,105C 'issu':101C,120C 'java':23B 'let':32B 'make':60B 'origin':41B,98C 'packag':24B 'profil':6A,55B,89C 'recommend':111C 'render':64B 'request':14A,68B,77C 'resourc':45B,95C 'same-origin':39B,96C 'send':67B 'server':12A,62B,75C 'server-sid':11A,74C 'side':13A,76C 'ssrf':79C 'svg':3A,25B,35B,66B,86C 'upgrad':113C 'url':70B 'user':109C 'version':115C 'vulner':80C 'xml':7A,27B,48B,83C,90C,104C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Apache Batik on the server to parse or render SVG files, especially SVG uploaded or supplied by users, are exposed. Applications that only use Batik on trusted, internal SVG content or do not use it at all can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["batik","java","package","svg","unknown"],"campaign_type":null,"search_a":"'-2026':17A,20A '-49236':18A,21A 'apach':1A 'base':8A 'batik':2A 'bypass':9A 'color':5A 'color-profil':4A 'cve':16A,19A 'enabl':10A 'forgeri':15A 'profil':6A 'request':14A 'server':12A 'server-sid':11A 'side':13A 'svg':3A 'xml':7A","search_b":"'1.19':31B 'apach':26B 'attack':58B 'attribut':50B 'base':49B 'batik':22B,29B 'bypass':37B 'check':42B 'choos':73B 'color':54B 'color-profil':53B 'craft':34B 'element':56B 'extern':44B 'file':36B 'graphic':28B 'java':23B 'let':32B 'make':60B 'origin':41B 'packag':24B 'profil':55B 'render':64B 'request':68B 'resourc':45B 'same-origin':39B 'send':67B 'server':62B 'svg':25B,35B,66B 'url':70B 'xml':27B,48B","search_c":"'1.19':108C '1.20':116C 'affect':102C 'apach':82C,103C 'base':91C 'batik':85C,93C,106C 'bypass':92C 'check':99C 'color':88C 'color-profil':87C 'extern':94C 'fix':118C 'forgeri':78C 'graphic':84C,105C 'issu':101C,120C 'origin':98C 'profil':89C 'recommend':111C 'request':77C 'resourc':95C 'same-origin':96C 'server':75C 'server-sid':74C 'side':76C 'ssrf':79C 'svg':86C 'upgrad':113C 'user':109C 'version':115C 'vulner':80C 'xml':83C,90C,104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49236","severity":null,"published_at":"2026-11-11T14:17:43+00:00","modified_at":"2026-11-11T14:17:43+00:00","first_seen_at":"2026-11-11T14:27:32+00:00","fetched_at":"2026-11-11T14:27:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}