Read the docs
TI-2017-03662 Aliases CVE-2017-5662GHSA-qwgx-59jw-qfg9

XML external entity injection in Apache Batik

Priority LOW 39CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 4 fixed, 5 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

Why it matters now

EPSS 0.04118 90th percentileScored 2026-11-07
Fix Partial Apache Batik (Apache Software Foundation): 1.9org.apache.xmlgraphics:batik (Maven): 1.9Red Hat: 3 advisoriesRed Hat: 4 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Batikbefore 1.91.9Patch availableCNA
—org.apache.xmlgraphics:batik (Maven)before 1.91.9Patch availableGHSA-qwgx-59jw-qfg9
  • Apache Batik VendorApache Affected before 1.9 Fixed in 1.9 Patch available CNA
  • org.apache.xmlgraphics:batik (Maven) Vendor— Affected before 1.9 Fixed in 1.9 Patch available GHSA-qwgx-59jw-qfg9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:*up to 1.8VulnerableApache
  • cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:* Versions up to 1.8 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Batik (Apache Software Foundation) Fixed in 1.9
  • Fix · GHSA-qwgx-59jw-qfg9 org.apache.xmlgraphics:batik (Maven) Fixed in 1.9 Advisory →

Red Hat 3 advisories

  • RHSA-2018:0319 Released 2018-02-14 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3
  • RHSA-2017:2546 Released 2017-08-29 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.4.5 security update
    • Red Hat JBoss BPMS 6.4
  • RHSA-2017:2547 Released 2017-08-29 · Red Hat rating Important
    Red Hat JBoss BRMS 6.4.5 security update
    • Red Hat JBoss BRMS 6.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix yet
Red Hat JBoss A-MQ 6.3Fixed RHSA-2018:0319
Red Hat JBoss BPMS 6.4Fixed RHSA-2017:2546
Red Hat JBoss BRMS 6.4Fixed RHSA-2017:2547
Red Hat JBoss Fuse 6.3Fixed RHSA-2018:0319

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5662
  2. 2026-10-03 Alias added: GHSA-qwgx-59jw-qfg9

References

Patch 1

Advisory 5

Other 4

  • TI-2018-05790 Deserialization of untrusted data in Apache Batik CVSS 3.0CRITICAL 9.8
  • TI-2020-09647 Improper input validation in Apache Batik CVSS 3.1HIGH 8.2
  • TI-2019-13109 Server-side request forgery in Apache Batik CVSS 3.1HIGH 7.5
  • TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
  • TI-2022-20096 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input CVSS 3.1HIGH 7.5
  • TI-2022-19036 Jar url should be blocked by DefaultScriptSecurity CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences