CVE-2026-90993

Published: Nov 11, 2026Modified: Nov 11, 2026

Description

XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (3)

https://issues.apache.org/jira/browse/BATIK-1399

Source: security@apache.org

https://lists.apache.org/thread.html/cnl5g2os5w048h32x50v1xgjnyo8y6vs

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/11/11/20

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.