Deserialization of untrusted data in Apache Batik
Priority MEDIUM 60CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Why it matters now
EPSS 0.18591 97th percentileScored 2026-11-07
Fix Partial org.apache.xmlgraphics:batik (Maven): 1.10Red Hat: 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Batik | 1.0 - 1.9.1 | — | No fix listed | CNA |
| — | org.apache.xmlgraphics:batik (Maven) | 1.0 to before 1.10 | 1.10 | Patch available | GHSA-25gw-4pcc-45cf |
- Apache Batik VendorApache Affected 1.0 - 1.9.1 Fixed in — No fix listed CNA
- org.apache.xmlgraphics:batik (Maven) Vendor— Affected 1.0 to before 1.10 Fixed in 1.10 Patch available GHSA-25gw-4pcc-45cf
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:* | 1.0 to before 1.10 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:a:oracle:business_intelligence:11.1.1.7.0:*:*:*:enterprise:*:*:* | 11.1.1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:11.1.1.9.0:*:*:*:enterprise:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* | before 8.3 | Vulnerable | Oracle |
- cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:* Versions 1.0 to before 1.10 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:a:oracle:business_intelligence:11.1.1.7.0:*:*:*:enterprise:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:11.1.1.9.0:*:*:*:enterprise:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions before 8.3 Vulnerable ·Oracle
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_metasolv_solution:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* | before 7.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* | 11.1.1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:* | 12.1.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 7.3.3.0.0 – 7.3.3.0.2; 8.0.0.0.0 – 8.0.7.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.2:*:*:*:*:*:*:* | 12.2.1.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3:*:*:*:*:*:*:* | 12.2.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* | 17.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* | 17.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* | 17.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:* | 10.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:* | 10.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2:*:*:*:*:*:*:* | 10.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:13.3:*:*:*:*:*:*:* | 13.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:13.4:*:*:*:*:*:*:* | 13.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14:*:*:*:*:*:*:* | 14 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:* | 5.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:* | 5.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_point-of-service:13.4:*:*:*:*:*:*:* | 13.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_metasolv_solution:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 7.3.3.0.0 – 7.3.3.0.2; 8.0.0.0.0 – 8.0.7.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.2:*:*:*:*:*:*:* Versions 12.2.1.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3:*:*:*:*:*:*:* Versions 12.2.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:* Versions 10.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:* Versions 10.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:13.4:*:*:*:*:*:*:* Versions 13.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_point-of-service:13.4:*:*:*:*:*:*:* Versions 13.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-25gw-4pcc-45cf org.apache.xmlgraphics:batik (Maven) Fixed in 1.10 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8013
- 2026-10-03 Alias added: GHSA-25gw-4pcc-45cf
References
Patch 4
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Advisory 6
Other 13
- [xmlgraphics-batik-dev] 20180523 [CVE-2018-8013] Apache Batik information disclosure vulnerability
- [xmlgraphics-commits] 20200615 svn commit: r1878851 - /xmlgraphics/site/trunk/content/security.mdtext
- [xmlgraphics-commits] 20200615 svn commit: r1878850 - /xmlgraphics/site/trunk/content/security.mdtext
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/apache/xmlgraphics-batik/commit/f91125b26a6ca2b7a1195f1842360bed03629839
- https://usn.ubuntu.com/3661-1
- https://ubuntu.com/security/CVE-2018-8013
- https://mail-archives.apache.org/mod_mbox/xmlgraphics-batik-dev/201805.mbox/%[email protected]%3e
- https://lists.apache.org/thread.html/rc0a31867796043fbe59113fb654fe8b13309fe04f8935acb8d0fab19@%3Ccommits.xmlgraphics.apache.org%3E
- https://lists.apache.org/thread.html/r9e90b4d1cf6ea87a79bb506541140dfbf4801f4463a7cee08126ee44@%3Ccommits.xmlgraphics.apache.org%3E
- https://issues.apache.org/jira/browse/BATIK-1222
More Apache Batik vulnerabilities
- TI-2020-09647 Improper input validation in Apache Batik CVSS 3.1HIGH 8.2
- TI-2019-13109 Server-side request forgery in Apache Batik CVSS 3.1HIGH 7.5
- TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
- TI-2022-20096 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input CVSS 3.1HIGH 7.5
- TI-2022-19036 Jar url should be blocked by DefaultScriptSecurity CVSS 3.1HIGH 7.5
- TI-2022-20886 Apache Batik prior to 1.16 allows RCE via scripting CVSS 3.1HIGH 7.5
Sources
- CVE-2018-8013 · CVE Program
- CVE-2018-8013 · NVD
- FIRST EPSS
- GHSA-25gw-4pcc-45cf · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8013 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences