XXE Vulnerability in Apache XML Graphics Batik Product
CVE-2026-90993

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Xml Graphics Batik
Vendor
CVE Published:
11 November 2026

What is CVE-2026-90993?

A vulnerability exists in Apache XML Graphics Batik that allows XML External Entity (XXE) attacks, potentially compromising the application and sensitive data. Users of versions up to 1.19 are urged to upgrade to version 1.20 to mitigate this security risk. Addressing this vulnerability is crucial for maintaining the integrity of the application and protecting user data against unauthorized access.

Affected Version(s)

Apache XML Graphics Batik 0 <= 1.19.0

References

https://issues.apache.org/jira/browse/BATIK-1399
issue-tracking
https://lists.apache.org/thread.html/cnl5g2os5w048h32x50v...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.