CVE-2019-17566: Server-side request forgery (SSRF) in Apache Batik
Summary
CVE-2019-17566: Server-side request forgery (SSRF) in Apache Batik. Affects org.apache.xmlgraphics:batik versions < 1.13. Fixed in 1.13. How to fix ↓
Also tracked for
- batik · Debian:11
The same CVE-2019-17566 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Batik is an open-source Java-based toolkit for rendering SVG (Scalable Vector Graphics) images. It provides a set of APIs and utilities for working with SVG files, including parsing, rendering, and manipulating SVG content. This vulnerability affects versions prior to 1.13 of the 'org.apache.xmlgraphics:batik' package in the Maven ecosystem.
Vulnerability Detail
The vulnerability in Apache Batik is a server-side request forgery (SSRF) issue. It arises due to inadequate input validation of the 'xlink:href' attributes. An attacker can exploit this vulnerability by supplying a specially-crafted argument, which can trick the server into making arbitrary GET requests. This can lead to unauthorized access to internal resources, information disclosure, or potential remote code execution.
How To Fix
Latest published version: 1.20 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to implement strict input validation and sanitization of the 'xlink:href' attributes. This can involve validating the input against a whitelist of allowed URLs or implementing a proxy server that filters and validates the requests made by Apache Batik.
Conclusion
Apache Batik versions prior to 1.13 are vulnerable to a server-side request forgery (SSRF) issue. This can be exploited by an attacker to make arbitrary GET requests and potentially gain unauthorized access or execute remote code. It is recommended to upgrade to version 1.13 or later of the 'org.apache.xmlgraphics:batik' package to mitigate this vulnerability. If immediate upgrade is not possible, strict input validation and sanitization of the 'xlink:href' attributes can serve as a temporary workaround. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.xmlgraphics:batik →
FAQ
Apache Batik is a Java-based toolkit for working with SVG images. It provides APIs for parsing, rendering, and manipulating SVG content.
Server-side request forgery (SSRF) is a vulnerability that allows an attacker to make arbitrary requests from the vulnerable server, potentially accessing internal resources or performing actions on behalf of the server.
This vulnerability in Apache Batik can lead to unauthorized access to internal resources, information disclosure, or potential remote code execution, depending on the actions allowed by the server.
To fix this vulnerability, upgrade to version 1.13 or later of the 'org.apache.xmlgraphics:batik' package. Alternatively, implement strict input validation and sanitization of the 'xlink:href' attributes.
If upgrading to the fixed version is not immediately feasible, you can implement strict input validation and sanitization of the 'xlink:href' attributes or use a proxy server to filter and validate requests made by Apache Batik.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.xmlgraphics:batik.
