{"id":"CVE-2026-90993","kind":"vulnerability","aliases":["CVE-2026-90993"],"related":[],"title":"Apache Batik: XML external entity flaw lets attackers read server files","description":"XXE vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.","summary":"Apache XML Graphics Batik, a Java library for processing SVG and XML graphics, has an XML external entity (XXE) flaw. A crafted XML input can make the application read local files or reach internal network resources.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["batik","java","package","svg","xml"],"not_affected_if":["batik-not-in-use","trusted-input-only"],"how_to_check":"- Look for Batik in your Java dependencies, for example `batik-all` or `batik-*` artifacts in your build file.\n- Check the version in use; the sources say versions through 1.19 are affected.","fix":"- Apache XML Graphics Batik: upgrade to `1.20`, per the advisory text.","status":"open","published_at":"2026-11-11T11:17:22+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","triaged_at":"2026-11-11T11:27:37+00:00","updated_at":"2026-11-11T11:27:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T11:27:37Z","model":"claude-haiku-5-5","output":{"fix":"- Apache XML Graphics Batik: upgrade to `1.20`, per the advisory text.","reach":"unknown","title":"Apache Batik: XML external entity flaw lets attackers read server files","impact":"medium","summary":"Apache XML Graphics Batik, a Java library for processing SVG and XML graphics, has an XML external entity (XXE) flaw. A crafted XML input can make the application read local files or reach internal network resources.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","batik","svg","xml"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server files readable and internal network requests possible via crafted XML","analyst_note":"Confirm the affected versions and the default parser behaviour in the Apache Batik advisory; the NVD entry gives no severity or exposure detail.","how_to_check":"- Look for Batik in your Java dependencies, for example `batik-all` or `batik-*` artifacts in your build file.\n- Check the version in use; the sources say versions through 1.19 are affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["batik-not-in-use","trusted-input-only"],"who_is_affected":"Applications that parse untrusted SVG or XML with Batik are exposed, because the XML parser can resolve external entities. Systems that only render trusted, internally generated graphics are lower risk. The sources do not describe the exact default parser configuration.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4503,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90993':14A,17A '1.19':74C '1.20':82C 'affect':68C 'apach':1A,23B,62C,69C 'applic':50B 'attack':8A 'batik':2A,18B,26B,65C,72C 'craft':44B 'cve':12A,15A 'entiti':5A,40B 'extern':4A,39B 'file':11A,53B 'fix':84C 'flaw':6A,42B 'graphic':25B,35B,64C,71C 'input':46B 'intern':56B 'issu':67C,86C 'java':19B,28B 'let':7A 'librari':29B 'local':52B 'make':48B 'network':57B 'packag':20B 'process':31B 'reach':55B 'read':9A,51B 'recommend':77C 'resourc':58B 'server':10A 'svg':21B,32B 'upgrad':79C 'user':75C 'version':81C 'vulner':60C 'xml':3A,22B,24B,34B,38B,45B,63C,70C 'xxe':41B,59C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse untrusted SVG or XML with Batik are exposed, because the XML parser can resolve external entities. Systems that only render trusted, internally generated graphics are lower risk. The sources do not describe the exact default parser configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["batik","high","java","package","svg","xml"],"campaign_type":null,"search_a":"'-2026':13A,16A '-90993':14A,17A 'apach':1A 'attack':8A 'batik':2A 'cve':12A,15A 'entiti':5A 'extern':4A 'file':11A 'flaw':6A 'let':7A 'read':9A 'server':10A 'xml':3A","search_b":"'apach':23B 'applic':50B 'batik':18B,26B 'craft':44B 'entiti':40B 'extern':39B 'file':53B 'flaw':42B 'graphic':25B,35B 'input':46B 'intern':56B 'java':19B,28B 'librari':29B 'local':52B 'make':48B 'network':57B 'packag':20B 'process':31B 'reach':55B 'read':51B 'resourc':58B 'svg':21B,32B 'xml':22B,24B,34B,38B,45B 'xxe':41B","search_c":"'1.19':74C '1.20':82C 'affect':68C 'apach':62C,69C 'batik':65C,72C 'fix':84C 'graphic':64C,71C 'issu':67C,86C 'recommend':77C 'upgrad':79C 'user':75C 'version':81C 'vulner':60C 'xml':63C,70C 'xxe':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T11:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90993","severity":null,"published_at":"2026-11-11T11:17:22+00:00","modified_at":"2026-11-11T11:17:22+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","fetched_at":"2026-11-11T11:26:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}