CVE-2026-89326CWE-346

CVE-2026-89326: vulnerability in Apache XML Graphics Batik

Apache XML Graphics Batik: Check url protocol when loading document

Published

Follow this CVE+ Monitor Apache XML Graphics Batik

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

0Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Track
Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Affected products
Apache Software Foundation · Apache XML Graphics Batik
Related CVEs — Apache XML Graphics Batik

In the same product, most dangerous first.

CVE-2022-44729—Apache XML Graphics Batik: Information disclosure vulnerabilityEPSS 0.9%CVE-2022-44730—Apache XML Graphics Batik: Information disclosure vulnerabilityEPSS 0.8%CVE-2026-44929—SSRF Vulnerability in Apache BatikEPSS —CVE-2026-49236—Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checksEPSS —CVE-2026-40853—Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFontEPSS —CVE-2026-111792—Apache XML Graphics Batik: Denial of Service via SVG Element Reference ResolutionEPSS —