CVE-2017-5662: Improper Restriction of XML External Entity Reference in Apache Batik
Summary
CVE-2017-5662: Improper Restriction of XML External Entity Reference in Apache Batik. Affects org.apache.xmlgraphics:batik versions < 1.9. Fixed in 1.9. How to fix ↓
Also tracked for
- batik · Debian:11
The same CVE-2017-5662 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Batik is a Java-based toolkit for applications that handle SVG (Scalable Vector Graphics) files. It provides a set of APIs and utilities for parsing, manipulating, and rendering SVG content. The vulnerability in Apache Batik (before version 1.9) allows maliciously formed SVG files to reveal files on the server's filesystem. The impact of this vulnerability depends on the user context in which the application is running. If the user has root privileges, it could lead to a full compromise of the server, including access to confidential or sensitive files. Additionally, the vulnerability can be exploited to launch denial-of-service attacks by triggering an amplification attack through XML external entity references.
Vulnerability Detail
The vulnerability in Apache Batik arises from improper restriction of XML external entity references (XXE). By sending specially crafted SVG files, an attacker can access files on the server's filesystem. The severity of the impact depends on the user context. If the user has root privileges, it could result in a complete compromise of the server. The vulnerability can also be used to launch denial-of-service attacks by exploiting XML external entity references. This vulnerability has a CVSS score of 7.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H).
How To Fix
Latest published version: 1.20 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Apache Batik as soon as possible.
Conclusion
The vulnerability in Apache Batik (CVE-2017-5662) allows maliciously formed SVG files to reveal files on the server's filesystem. It can lead to a full compromise of the server if the user has root privileges. Upgrading to Apache Batik version 1.9 or later is the recommended solution to fix this vulnerability. There is no known workaround, so it is crucial to update the package as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.xmlgraphics:batik →
FAQ
Apache Batik is a Java-based toolkit for handling SVG files. It provides APIs and utilities for parsing, manipulating, and rendering SVG content.
The impact of this vulnerability depends on the user context. If the user has root privileges, it could lead to a full compromise of the server, including access to confidential or sensitive files. It can also be used to launch denial-of-service attacks.
To fix this vulnerability, it is recommended to upgrade to Apache Batik version 1.9 or later. This version includes a fix for the improper restriction of XML external entity references.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Apache Batik as soon as possible.
The CVSS score of this vulnerability is 7.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H).
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.xmlgraphics:batik.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
