PT-2026-145229
CVE-2026-49236
·
Published
2026-11-11
·
Updated
2026-11-12
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache XML Graphics Batik versions prior to 1.20
Description
Server-Side Request Forgery (SSRF) occurs when a crafted SVG file uses a malicious
xml:base URL to bypass same-origin checks for external resources. This allows the application to make unauthenticated requests to attacker-chosen URLs, which can be used to probe internal services reachable from the host.Recommendations
Upgrade to version 1.20.
Monitor HTTP requests for unusual
xml:base values. Found an issue in the description? Have something to add? Feel free to write us 👾