CVE-2017-5662
Improper Restriction of XML External Entity Reference in Apache Batik
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
CVE-2017-5662- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - CVSS 2.0
- 7.9 High
AV:N/AC:M/Au:S/C:C/I:N/A:C - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
CVE-2017-5662- Updated
- 2026-11-02
EUVDEUVD-2022-5045 No score
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
EUVD-2022-5045- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qwgx-59jw-qfg9
Improper Restriction of XML External Entity Reference in Apache Batik
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
GHSA-qwgx-59jw-qfg9- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
CVE-2017-5662- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-5662
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
DEBIAN-CVE-2017-5662- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-qwgx-59jw-qfg9
Improper Restriction of XML External Entity Reference in Apache Batik
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
GHSA-qwgx-59jw-qfg9- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5662
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
- Record
UBUNTU-CVE-2017-5662- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1778633124 No score
TuxCare security update for org.apache.xmlgraphics (10 CVEs)
TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.
- Record
CLSA-2026-1778633124- Updated
- 2026-11-02
OSVSUSE-SU-2024:0777-1 No score
Security update for xmlgraphics-batik
This update for xmlgraphics-batik fixes the following issues:
- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).
- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).
- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).
- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).
- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).
- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).
- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
- CVE-2022-44729: Fixed Server-Side Request Forgery.
- CVE-2022-44730: Fixed Server-Side Request Forgery.
Upgrade to version 1.17.
- Record
SUSE-SU-2024:0777-1- Updated
- 2026-11-02
OSVUSN-3280-1 No score
batik vulnerability
Lars Krapf and Pierre Ernst discovered that Apache Batik incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from the filesystem, or cause a denial of service.
- Record
USN-3280-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.xmlgraphics:batikMaven |
before 1.9 | 1.9 |
org.apache.xmlgraphics:batik-animTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-awt-utilTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-bridgeTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-codecTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-cssTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-domTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extensionTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extensionsTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.xmlgraphics:batik-gui-utilTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-gvtTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-jsTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-parserTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-rasterizerTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-rasterizer-extTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-scriptTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-slideshowTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-squiggleTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-squiggle-extTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svg-domTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svggenTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svgppTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-swingTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-transcoderTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-ttf2svgTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-utilTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-xmlTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
batikDebian:12 |
before 1.9-1 | 1.9-1 |
batikDebian:13 |
before 1.9-1 | 1.9-1 |
batikDebian:14 |
before 1.9-1 | 1.9-1 |
batikDebian:7 |
before 1.7+dfsg-3+deb7u2, plus listed versions 1.7+dfsg-31.7+dfsg-3+deb7u1 |
1.7+dfsg-3+deb7u2 |
batikDebian:8 From an advisory covering 2 CVEs |
before 1.7+dfsg-5+deb8u1, plus listed versions 1.7+dfsg-5 |
1.7+dfsg-5+deb8u1 |
batikDebian:9 From an advisory covering 2 CVEs |
before 1.8-4+deb9u1, plus listed versions 1.8-4 |
1.8-4+deb9u1 |
xmlgraphics-batikSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 10 CVEs |
before 1.17-2.7.1 | 1.17-2.7.1 |
batikUbuntu:14.04:LTS |
before 1.7.ubuntu-8ubuntu2.14.04.2, plus listed versions 1.7.ubuntu-8ubuntu21.7.ubuntu-8ubuntu2.14.04.1 |
1.7.ubuntu-8ubuntu2.14.04.2 |
batikUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.7.ubuntu-8ubuntu31.8-31.8-3ubuntu11.8-3ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5662 is a high vulnerability (CVSS 7.3) in Apache Batik, published April 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.12%, the 90th percentile. Fixed in org.apache.xmlgraphics:batik 1.9.
References
access.redhat.com/errata/RHSA-2017:2547
securitytracker.com/id/1038334
debian.org/security/2018/dsa-4215
securityfocus.com/bid/97948
Show 31 moreShow less
oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
xmlgraphics.apache.org/security.html
nvd.nist.gov/vuln/detail/CVE-2017-5662
github.com/advisories/GHSA-qwgx-59jw-qfg9
security-tracker.debian.org/tracker/CVE-2017-5662
suse.com/support/update/announcement/2024/suse-su-20240777-1
bugzilla.suse.com/1034675
ubuntu.com/security/CVE-2017-5662
openwall.com/lists/oss-security/2017/04/18/1
cve.org/CVERecord?id=CVE-2017-5662